Re: Have Virus - Need Help


Michael Fischer Wrote:
The recommendation from the IT folks was to do a Windows restore or a
Windows
re-install. I'm a little naive here, so would a restore (which I don't
even
know how to do, so I have to track that down) work in a case like
this?
Everything I've read for viruses says no, but in this case, it sounds
like it
may not actually be a virus.

And here's a total exposure of my naivete. If I do need to go the route
of
re-installing Windows, do I need to worry about existing hardware and
software being reconfigured?

"David H. Lipman" wrote:

From: "Michael Fischer" MichaelFischer@xxxxxxxxxxxxxxxxxxxxxxxxx

| I do get the NT SYSTEM AUTHORITY message when disconnected from the
Internet.
| I do not get the message when starting in safe mode. The hole issue
started
| after installing VPN software from my employer which disabled my
Kaspersky
| anti-virus and installed McAfee. McAfee is installed and up to
date. When I
| run it, it does not find any virus, nor does the Microsoft
Malicious Software
| Removal tool. I'm really at a loss.
|

It is NOT a virus issue (although you had Registry settings
indicative of the Lovsan/Blaster
at one time) as indicated by the shutdiown message being seen when
NOT connected to the
Internet. This means it is not an attempt at a TCP port 135
exploitation but a problem with
the RPC/DCOM sub-system.

Remove the VPN software as it looks like it is the cause. Contact
the MIS/IT support
personnel of your company and tell them the VPN is causing the
problems thus described.
They will be *best* to support you with the VPN issue.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm




hi i need to know what msblaster is?
how to fix it ?
and how to prevent it ?

it is really confusing trying to search for it on the net!!!


--
helpi
.

Relevant Pages

  • Re: 3389 problems
    ... Have you tried uninstalling the VPN software and test again? ... I seem to recall this starting after installing ... more than likely have a firewall blocking the port. ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: Have Virus - Need Help
    ... | I do get the NT SYSTEM AUTHORITY message when disconnected from the Internet. ... | after installing VPN software from my employer which disabled my Kaspersky ... Remove the VPN software as it looks like it is the cause. ... Contact the MIS/IT support ...
    (microsoft.public.windowsxp.security_admin)