Re: Weird actions of blaster?
From: Pavan (a-papedi_at_online.microsoft.com)
Date: 08/15/03
- Next message: Dr Zoidberg: "Re: Upside Down Windows XP"
- Previous message: Thomas O'Grady [MSFT]: "Re: must have the bug"
- In reply to: Jeanne: "Re: Weird actions of blaster?"
- Next in thread: Jeanne: "Re: Weird actions of blaster?"
- Reply: Jeanne: "Re: Weird actions of blaster?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 15 Aug 2003 09:13:30 -0700
Jeanne,
As of August 14, 2003, several variants of the original worm have been
confirmed that use different file names. Follow these steps to also search
for files that are named Nstask32.exe, Penis32.exe, Teekids.exe,
Winlogin.exe, Win32sockdrv.dll, and Yuetyutr.dll. If any of these files are
found, contact your antivirus software vendor for removal information. For
additional information about these variants, see the following Symantec
Corporation Web sites:
a.. W32.Blaster.C.Worm: Teekids.exe
http://www.sarc.com/avcenter/venc/data/w32.blaster.c.worm.html
b.. W32.Blaster.B.Worm: Penis32.exe
http://www.sarc.com/avcenter/venc/data/w32.blaster.b.worm.html
c.. W32.Randex.E : Nstask32.exe, Winlogin.exe, Win32sockdrv.dll, or
Yyuetyutr.dll
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.e.html
Pavan
"Jeanne" <jeannemurie@nemontel.net> wrote in message
news:047e01c36336$8595b2b0$a001280a@phx.gbl...
> Pavan,
>
> I've done all of this but after step 6 I can go no
> farther. As you will notice in my first post there IS
> NOT A msblast.exe in my processes or msconfig, non in my
> registry nothing, it will not show up. Any more ideas? I
> know I have it as my RPC will shut down my computer and
> that my norton warning box will pop up a couple of times
> to tell me I am infected with the msblast.exe but norton
> scan and the fixblast tool will not pick up the
> virus...frustrating! If you would please e-mail me
> privately. jeannemurie@nemontel.net
>
> Jeanne
> >-----Original Message-----
> >"If you are infected by a Virus:
> >
> > 1.. Disconnect your PC from the internet
> > 2.. We need to stop the RPC service restarting the PC,
> click HERE for a
> >visual walkthrough of how to do it or, click START, and
> then RUN. Type in
> >SERVICES.MSC and click OK
> > 3.. Scroll down for the Remote Procedure Call (RPC)
> service and double
> >click it
> > 4.. Now click on the RECOVERY tab
> > 5.. In the FIRST FAILURE, SECOND FAILURE and
> SUBSEQUENT FAILURE drop down
> >boxes, choose TAKE NO ACTION. Now click OK. Your PC will
> now stay turned on
> >should the RPC crash
> > 6.. Download a firewall. If you don't have one,
> Visualante can point you
> >in the direction of a few good free ones HERE. The
> Windows XP firewall
> >doesn't appear to be very affective against this. You
> can go online now and
> >not worry about the PC shutting down. If you already
> have a firewall, click
> >HERE to see how to configure it to block these attacks
> > 7.. Click on START, then RUN and then type in
> MSCONFIG. Click OK
> > 8.. Click on the STARTUP tab at the top. Look for
> WINDOWS AUTO UPDATER or
> >MSBLAST.EXE and click the tick next to it to stop it
> running. Now click OK
> > 9.. Restart your PC
> > 10.. Click on START, and then RUN, type in REGEDIT
> > 11.. On the new window, click on EDIT and then FIND.
> Type in MSBLAST* and
> >click FIND NEXT
> > 12.. As soon as the search finds an entry, press the
> DELETE key and remove
> >it
> > 13.. On your hard drive, go to C:\WINDOWS\SYSTEM32 and
> remove the
> >MSBLAST.EXE* file "
> >------ From http://www.visualante.org/msblast/
> >
> >Visit:
> http://v4.windowsupdate.microsoft.com/en/default.asp
> >
> >
> >
> >For more Information Visit
> http://www.visualante.org/msblast/
> >
> >"Jeanne" <jeannemurie@nemontel.net> wrote in message
> >news:01c301c36291$49482270$a401280a@phx.gbl...
> >> Or maybe this is normal...I have and have always had my
> >> norton up to date for live up date. Then my comptuer
> >> pops up with the 'red alert' box from norton that my
> >> computer is infected with the blaster worm. I cannot
> >> quarantine or anything, only can hit ok. This will
> always
> >> pop up twice in a row. Then I do a system scan in all
> >> files for a virus, and it won't show up, I've
> downloaded
> >> the fixblast tool from norton to fix it and it says my
> >> computer is not infected. After connecting to the
> >> interent my machine gives me the 1 min countdown to
> >> restart. I have since turned my RPC to not restart my
> >> computer but to restart the service if it's interuppted
> >> so I could get the patch put on. Also in my processes
> the
> >> msblast.exe doesn't show up and my registry doesn't
> have
> >> the added key to run the ms blast. My question is how
> >> the heck do I get rid of it? Am I going to have to
> >> completely reinstall my XP?
> >> Thanks for any help!
> >> Jeanne
> >>
> >
> >
> >.
> >
- Next message: Dr Zoidberg: "Re: Upside Down Windows XP"
- Previous message: Thomas O'Grady [MSFT]: "Re: must have the bug"
- In reply to: Jeanne: "Re: Weird actions of blaster?"
- Next in thread: Jeanne: "Re: Weird actions of blaster?"
- Reply: Jeanne: "Re: Weird actions of blaster?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
