Problems with Win2k

[Kabob]

I just built a new system, and now whenever I install windows (this is about the 5th time since yesterday afternoon...) it keeps messing up. When I try using the internet, it keeps doing the "detecting proxy settings" thing, and every once in a while it'll work. Also, every time AOL Instant Messenger starts up for the first time, it gets an error and has to close.

Also, sometimes I get an error that says I have a problem with "C:\WINNT\System32\lsass.exe" and says I had status code 128. I checked on the Microsoft home page and they told me how to fix it, but when I tried it didn't work. Said I didn't have authorization to do so. Once I get this error message, it tells me I have 1 minute to save stuff before it restarts.

I've been having problems downloading Windows updates (keeps messing up or freezing partway through alot of them)

Finally, my system has taken on the habit of restarting itself when trying to load certain programs, etc. Sometimes it even restarts while trying to load windows (which is usually followed by me reformatting AGAIN!)

My old system never had any problems like this! Can anyone help me out!!

My old system:
-Dell Dimension 4100
-P3 933MHz
-20GB IDE HD
-383MB RAM
-GeForce FX 5200
-Stock Mobo (Intel made methinks)
-Windows 2000 PRO

My new system:
-Custom built (by me...)
-AMD Athlon 64-M 3200+ (have it running at stock speeds)
-1024MB Kingmax Hardcore PC4000 (have it running at PC3200 speeds)
-ASRock K8S8X (I got this and the CPU used from a guy here at Anandtech. Any chance that it could be -my BIOS? Could it be connections to my mobo??)
-HD/DVD/CD-RW taken from old system
-MGE Soho H2 case w/400W PSU(any chance the PSU could be causing problems? Seems like that'd be kind of odd...)
-Windows 2000 PRO

Anyone have any ideas what the problem could be? My friend has offered to give me a copy of Windows XP PRO (he can get it cheap)...would that possibly be any better??

Thanks for any help y'all can be!!

-Kabob

 

[mechBgon]

ooops, double post We won't charge you for this one

 

[mechBgon]

Sounds like your computer is being repeatedly infected by worms. To fix this, you need to install Windows while disconnected entirely from your modem and then get a firewall in place, whether that's a router or free ZoneAlarm, which you can get here. Before connecting the computer to the modem, also set STRONG passwords on all your Administrator-class user accounts to deter share-hopping worms.

After installing ZoneAlarm, install your antivirus software. Then connect the computer to the modem, update your antivirus software first, and then go to Windows Update and get the first load of updates. Keep going back until it has no further Critical Updates to offer. That could be four visits anymore. If you have Office, install it and then do likewise at Office Update.

After getting that stuff done, also run Microsoft Baseline Security Analyzer 1.2.1, which you can get from here, run it, and see how you did. You'll probably need to go to Control Panel > Administrative Tools > Local Security Policy > Local Policies > Security Options and set the first item to "No access without explicit anonymous permissions," which MBSA will point out to you too.

Hope that's a help If you have broadband, however, go get yourself a Netgear RP614 or Linksys BEFSR41 to be your outer firewall too.

 

[mechBgon]

Oh, and yes, your PSU could be causing crashes too, due to lack of quality. Get a nice Enermax, Fortron or Antec.

Bonus tip: crank up the memory voltage to 2.7 volts on that PC3200 while you're at it. Undervolted RAM won't do you any favors either.

 

[bendixG15]

My experience is that reformat isn't enough.
Now I write all zeroes amd then reformat.

I also understand that some viruses can survive a write zero operation.
Fortunately, I didn't have any..

Good Luck from Massachusettes where its 19-0 with the Patrios

 

[Vaco]

I have seen it once, never happend to me, but that one second shutdown message could be someone taking advantage of a windows exploit. Do you get that one minuet shut down message when you are off line or on line? Try keeping your computer off line and see what happens with that one minuet shut down.

 

[Kabob]

The thing is, why am I getting all these viruses and such now? I never had problems with them when I had my old system setup. When I get these error messages, it's usually when I'm online. Usually they start occuring after I've installed a driver to something. And I honestly don't think that it's the PSU that's causing all the problems. When the system restarts, it's always at the same point. Plus...at the moment I'm out of $$ to upgrade. The next thing I want to upgrade is my Vid Card if I can...but I guess a nice vid card won't do me much good if my computer doesn't work!

Why would following Microsoft's steps not work anyways?? Is there some type of virus causing this?

As for setting up a firewall, I'm on a University connection with a built in firewall. I don't have any "administrator" passwords to get into windows...heck, I don't have any passwords at all. What do you mean "Strong" passwords?? Rediculously long and overly detailed?

And that's a ton of stuff to do to get this thing working again mechBgon, is all that stuff necessary?? If it'll get it working, I'd do it.

The RAM isn't PC3200, it's PC4000. My mobo however cannot go above 2.65 volts. I also can't figure out how to allow the ram to go above 200MHz...even though the RAM I have should hit 250MHz @2.5v.

Also, is there any benefit to moving to Windows XP? Could that solve any problems?

Thanks and keep the info coming!!

-Kabob

 

[Vaco]

Could be someone on the dorm network. Sure you are behind a firewall to the internet, but are you protected from the guy down the hall?

I would suggest, if you decide to reinstall windows again, that you get a different copy of windows. Not a different version, mearly a different disk. Your cd could be corrupt, esp if it is not an orginal, assuming your cdrom drive is in good condition.

 

[Kabob]

I don't have a different disk...but as stated...I will have a different version probably this week. Well, I've got 5 secs till the restart

 

[dclive]

Originally posted by: kabob983
I don't have a different disk...but as stated...I will have a different version probably this week. Well, I've got 5 secs till the restart

As previously stated, get a fresh install of Win2k on there (while disconnected from your network - all networks), turn on Windows 2000's firewall, and then install SP4 on there, and then install all other Microsoft updates - all while disconnected from your network. Then install antivirus software. THEN put yourself on the network.

You can abort the shutdown by copying XP's shutdown.exe program (in c:\windows\system32) to the WIndows 2000's c:\winnt\system32 directory, and then just typing "shutdown -a" to abort the shutdown.

You are infected with a Sasser-style worm. Another way to resolve this is to simply do all your Windows 2000 updates, get a good antivirus product on there, and run a few worm-removal tools. But you do badly need to update Windows 2000 to resolve that exploit.

And you need to have an administrative password on the machine, plus a password for any additional accounts on the machine. And since your machine has been compromised, there may be additional accounts on the machine you didn't know about - another reason to reformat.

A simple reformat & reinstall will resolve this issue, too.

 

[kazeakuma]

Originally posted by: kabob983
The thing is, why am I getting all these viruses and such now? I never had problems with them when I had my old system setup. When I get these error messages, it's usually when I'm online. Usually they start occuring after I've installed a driver to something. And I honestly don't think that it's the PSU that's causing all the problems. When the system restarts, it's always at the same point. Plus...at the moment I'm out of $$ to upgrade. The next thing I want to upgrade is my Vid Card if I can...but I guess a nice vid card won't do me much good if my computer doesn't work!

Why would following Microsoft's steps not work anyways?? Is there some type of virus causing this?

As for setting up a firewall, I'm on a University connection with a built in firewall. I don't have any "administrator" passwords to get into windows...heck, I don't have any passwords at all. What do you mean "Strong" passwords?? Rediculously long and overly detailed?

And that's a ton of stuff to do to get this thing working again mechBgon, is all that stuff necessary?? If it'll get it working, I'd do it.

The RAM isn't PC3200, it's PC4000. My mobo however cannot go above 2.65 volts. I also can't figure out how to allow the ram to go above 200MHz...even though the RAM I have should hit 250MHz @2.5v.

Also, is there any benefit to moving to Windows XP? Could that solve any problems?

Thanks and keep the info coming!!

-Kabob

I think mechBgon has got it. I see this regularly where I work (university) when people try installations themselves (not to say they can't do it, but most don't realise the problems worms can cause). The one minute shutdown message is also indicative of a Blaster type worm, also you may have blocked sites etc. WindowsUpdate rarely works when you are infected with Blaster variants as your networking is shot to hell. Here's a couple of things you can check to make sure if you wish. Turn on the LAN connection system tray display (under properties on the LAN connection). I find this handy, as a quick glance can tell you if you're network traffic is going nuts (flashing icon) while you're not doing anything. Also have a look in your services under, Control Panel->Administrative Tools->Services and look for suspicious services. Unfortunately I can't remember the common service name it uses (been a while) but it's usually something ridiculous eg. XXXX.EXE with no description field.

While it is possible to retrieve your PC in it's current state (a blaster/variants removal tool should do the job), I personally prefer to install via mechBgon's method because it's a 'Clean' install. Too often have I seen PCs with an early infection like yours causing problems that Windows just shouldn't have down the line. While it sounds like a lot of work, it really isn't and once you have a good install routine down pat you will be surprised at how little effort it can be, and just how much better your PC will run.

Just my 2 cents

PS: Set an administrator password!
Too many worms exploit exploit weak/nonexistent passwords by tapping into your $ shares (default windows administrator only shares of your entire hard drives) and infecting your pc that way. There are other methods they use as well but all depend on a 0 length or very basic administrator password. A strong password usually contains letters and numbers, capitalisation and special characters ($#%^etc). Not necessarily all at once (few people I know ever use special characters) but capitalisation works wonders just not at the start of the password. If you don't usually use one, then I recommend creating one for the administrator account (prompts for this during setup) writing it down somewhere safe and creating a user for yourself once windows is up and running. You can then set it to autologin with this user as well if you don't like the hassle of logging in.

 

[mechBgon]

^^ good advice from these guys too.

kabob983, regarding the Administrator passwords, go to Start > Settings > Control Panel > Administrtative Tools > Computer Management and then in the CM console, go down to System Tools > Users & Groups > Users and you should see something like this. Whether you use password-type login yourself or not, the Administrator account is there under the surface, and it should have a suitably-strong password like v1rusBgon!1one. If you go about ten+ characters with some symbols, caps, numerals and not dictionary-based, that's "strong." To change a password in the console, right-click the username and the menu will offer that option.

If I were in your situation, I would definitely pick up one of these Netgear RP614's in addition to running ZoneAlarm, and put the University on the WAN port to firewall my computer from the other computers on the University network. If you don't have current antivirus software, grab OEM McAfee VirusScan 8.0 for $12 with that. It comes pretty tight right out of the box, not much configuring needed.

Hope that helps you out.

 

[Kabob]

Originally posted by: dclive
A simple reformat & reinstall will resolve this issue, too.

That didn't work, I've tried. Every time I reinstall Win2k, it gives the same errors, and I've reformatted every time...

OK, so I just wrote a really long message about how I was going to do this, but my awesome University connection died for a second, so now I'm writing it again for the 2nd time...hooray!!

I'll try using mech's method, so lets see if I've got this right:

1. Reformat my HD and install Windows 2000 while my LAN cable is unplugged from my system.

2. When prompted, create an administrator password consisting of 10 or more letters and number and including symbold like !@)#% and caps.

3. Once Windows is up, install Zone Alarm (still don't know what this does. Is this a firewall program? How exactly do I use it? Should I just throw the install file on a CD?) and run it.

4. Install antivirus software (I have Norton Antivirus Corporate Ed. which I got from my university, will that work well enough?? I didn't get any bugs on my last system...should I shoot for MacAfee??) and update it.

5. Get any critical windows updates and install them.

6. Install and run Microsoft Baseline Security Adviser 1.2.1 and run it (what does this do?? Show me what stuff is running on my computer??)

7. Hope and Pray that my computer works well now that I've done all this junk.

So, how's that look? Any additions, ideas, etc??

Thanks for all the help guys!!

-Kabob

P.S. Where would I have gotten this "Blaster Worm" from?? I didn't have any problems before the reformat, and it's not like I'm downloading tons of stuff from the internet. Usually just a driver or a critical update off of window's website.

P.P.S. Should I update my mobo's BIOS? If so, how the heck do I do so? I went to the maker's website and downloaded a program called FLASH.exe and a zip file containing the update, but I'm supposed to put it on a system disk and I dunno how to make one. I didn't think that'd be the same as the window's boot disks I use when reformatting and installing Windows...

 

[mechBgon]

The Blaster or Sasser worm would be coming from other computers on the University network. Basically, they ask your raw, naive, unpatched Win2000 installation "would you like some candy, little girl? :evil: " and your computer is not patched so it says "sure!" Your previous Win2000 installation was probably patched-up enough to resist the offer. Your fresh installation, however, is not.

ZoneAlarm is a firewall software (as you can see if you bother to read the download page) that will keep your computer's vulnerable Win2000 installation from being attacked by the worms while you get patched up, which is why ZoneAlarm should be installed and configured BEFORE you plug into the network.

I'm not sure how much pre-configuration the University has done on the Norton installer, but if they've left you the option to update it and/or configure it, you should update it ASAP after you do connect to the network. ZoneAlarm will begin asking questions about whether you want Norton's component programs, and other programs as well, to be allowed to access the "outside," and you will have to answer those questions initially for many programs. It will probably also begin showing you alerts that it's been blocking attack traffic from the outside.

Don't disable ZoneAlarm unless you have some other firewall already in place, whether that's a router or another firewall software. Keep up on your patches at Windows Update and Office Update, check your antivirus software to ensure that it's up-to-date and that its settings are maxed out (if you're allowed control of them), and also replace that generic power supply with a good one Don't need your system being unreliable at school... I mean, you might be about to make a brilliant flag capture or something when it crashes :Q or there's always that paper you worked on for six hours too

 

[Markfw]

You DO have the blaster or sasser virus, per that exe message about lass.exe. As mech said, after disconnecting your PC from the internet, get not ony a firewall, but good virus protection. Then see if it is possible to get the SP4 on a CD from a friend who downloaded the update as a separate exe, and update number 833330 (per microsofe.com)

Also check this web page You DO have that problem. And allways listen to mechbgon.

 

[Kabob]

Originally posted by: mechBgon
The Blaster or Sasser worm would be coming from other computers on the University network. Basically, they ask your raw, naive, unpatched Win2000 installation "would you like some candy, little girl? :evil: " and your computer is not patched so it says "sure!" Your previous Win2000 installation was probably patched-up enough to resist the offer. Your fresh installation, however, is not.

I mean, you might be about to make a brilliant flag capture or something when it crashes :Q or there's always that paper you worked on for six hours too

LOL, quite possibly some of the funniest ways I've heard that put ever. I love the "would you like some candy, littke girl?" Wow, you made my night mech.

And Mark, I'll get on that right when I get back to my room. (I'm working in the computer lab for the next 10 mins...the shift's finally over!! hooray!)

Thanks for everything!!

-Kabob

 

[Kabob]

BTW Mark, wanna trade systems?? Mine for your Dual Opteron

Also, nice RX-8. I still prefer the RX-7 though, twaz an awesome vehicle...

-Kabob