Virus? Mobo?

[WillShakespeare]

Hi all,

I have a serious problem. A machine I built for a friend of the family with an Athalon Sempron, and 512 DDR 333 RAM was working great for the last 3 months. suddenly, booting, it sayas it can't find a file in the SYSTEM32 directory.
This error message also suggests selecting "r" from the IWndows XP boot disk to repair and replace this file. Problem is that when I boot up to the CD, it gets through loading the various required files, and then says "WIndows is Starting up" in the message screen at the bottom of the blue dos-like install screen, and hangs. No response from Num-lock, and no response from the computer. I have left it all day for 8 hours, too, but still no joy. Definitely hangs. So... I borrowed my father-in-laws CD, in case it was the CD... but this fails even sooner, and simply reboots at a certain point while copying the files.

Now, I can boot to dos, but if I do, and run setup from the CD... same problem.

I can boot to boot-itNG (

http://www.bootitng.com)

and I can resize partitions, and check the disks, etc. In dos, I have check-disked, and other things. No problems.

But if I try to reload wondows, forgetting repair, I can't get passed the setup section mentioned above.

Do you think this might be a Windows virus? The Mobo seems okay. It is an Abit VA-10 v.1.3 but I don't really know how to test individual things like the memory, etc. The initial memory tests by the mobo during POST works fine with no errors. The 2 hard-drives and the CD-ROM (RW) drive is picked up fine.

I suspect a virus, but not sure what to do. SHould I get hold of a boot virus checker? If so, any suggestions on a good one? I use AVG, and it has always served me well. In fact it is also installed on the troubled machine. But they have a rescue disk, but doesn't seem to have a boot option... maybe I should just try it and see...

Any help on this, anyone seen similar, I would appreciate greatly!

Will

 

[gpalmer711]

I had a similar problem recently that was attributed to the Graphics Card.

I was able to boot to any linux or dos based boot disks, however as soon as I tried either Windows setup or something like BArtPE it would either blue screen or hang.

Do you have a spare one you can try?

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[WillShakespeare]

Hi greg,

Thanks for the tip. Turns out it was memory. I downloaded, from advice, a linux based memory testing tool called MemTest86 (

http://www.memtest86.com)

and it discovered the problem immediately. So I took out one of the dual 256 MB sticks (from Crucial) and tested one at a time, twice. The same chip had errors all over the place, while the other had none. SO now the system is running great on 256, while I await a replacement from Crucial. They said in a day or two, so maybe by the weekend.

Interesting that none of my other things caught the memory problem. The mbo was flying along regardless of the problem! Who knows... maybe there is a virus on the duff memory chip? They said they'd let me know... so if they do, I will let you all know too!

Will

 

[BaudKarma]

A virus on the memory chip?

I try not to let my ignorance prevent me from offering a strong opinion.

 

[WillShakespeare]

why not? memory isn't always volatile. Sure most memory is, but if it could keep a static charge then surely some clever programmer out there could write some code that would stay in one place, and combat attempts to move it.

I know it's a stab in the dark, but i'm not suggesting God is in the chip somewhere...

 

[gpalmer711]

BaudKarma,

There is no need for that sort of opinion on this forum. The skill level of member ranks from mimimal to expert and we welcome all comments no matter how stupid the poster or other members may think they are.

While it is highly unlikely that someone has written a virus that could become persistant in memory due to a continuous power supply to the ram stick. It wasn't that long ago that people would have said the internet wasn't possible, and now look at it.

So have some respect for you fellow man.

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[Turkbear]

Hi I agree that comments about knowledge levels are out of order here, we all started ignorant. ( That, by the way, is not a pejorative - it just means lacking knowledge - all of us lack some knowledge).
Actually, it would be very difficult to get RAM to act like an EEPROM or some other non-volatile chip..as soon as you turn off the machine the RAM empties..It needs power.
( Unless someone comes into your house and rewires your PC to add a permanently on power supply to the memory chip, without your knowledge - in which case a possible virus is not your biggest concern).

 

[micker377]

True knowledge is what you learn after you know it all!

 

[BaudKarma]

In case anyones confused, I just asked about the virus on the memory chip because I'd never heard of such a thing. The "ignorance" line is my sig.



I try not to let my ignorance prevent me from offering a strong opinion.

 

[gpalmer711]

Then I apologise BaudKarma totally my mistake

As for the possibilities of a virus on the Memory Stick, yes there is a small possibility.

When you power down your PC but leave it plugged in at the wall socket there is still a small charge of electricity that is powering your motherboard (it needs this to be able to detect when you press the on button on your case).

However the usefulness of something like this in mainstream virus/trojan writting is minimal. You would probably still need to have files installed to the harddrive that would reference the area of ram that the virus is located at and as Turkbear states as soon as you remove the power source completely the memory clears anyway.


Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[WillShakespeare]

Well, the reason I wonder is because I have a USB pen drive, which is essentially cheap non-volatile solid state memory. It has no onboard power, and yet when it gets power, it suddenly "remembers" the data it had on it from the beginning.

The minimal-ness of writing viruses that "stay" in memory I'm not convinced about. Surely the goal of a virus is to survive beyond all else. Sure it either does or doesn't do damage, but if it survives, then it can breed, which is what viruses do. If a virus woulc keep itself in memory, even when the machine is off, then it could effectively make any attempts to get rid of it fail from a lowest level. I'm saying this is possible, just wondered if it was.

I also thought that potentially, a clever virus could reside on the BIOS, until cleared, and then, during POST, it could load itself into the RAM, making the RAM unusable. This would have the "effect" of being non-volatile on volatile RAM. The memory woul;d be fine on its own, but when in the infected machine, "appear" to be faulty or have a virus on it.

To BaudKarma, I didn't take it the wrong way... I just thought you were playing devils advocate!

Will

 

[pcs007]

Hi WillShakespeare,
The type of memory used in USB flash drives is different from the RAM used in the computer. Flash memory behaves like ROM which retains data even when no power is applied to it. But RAM will lose their data when the power is cut. So the chance of virus residing in RAM is minimal, but some virus do invade the ROM on the computer and thus rendering the motherboard useless.

A nice and short description of memory types:

http://www.netrino.com/Publications/Glossary/MemoryTypes.html