Blaster?

[bilebalar]

My computer is running in turtle speeding, nothing would run. I found the msblaster.exe in the registry. I deleted it and installed all the MS patches + SP4. I ran the Norton made removal kit, it found nothing. I ran my Mcafee virus scan (with the lastest update), it didn't find anything either. I can't go to my winnt/system32 folder.
What else should i do?

Thanks.

 

[NortonES2]

Would try this:-

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

-------------------------------

If it doesn't leak oil it must be empty!!

 

[bilebalar]

Yes, this is the Norton made removal kit I was talking about in my 1st post. It found nothing.

Update: Since I can't go to my system32 folder to check whether there's any msblaster file, I checked at the command prompt. I saw the whole list of files in my WINNT and my WINNT/system32 folders... they both don't have anything named blaster, msblaster....

Any idea?

Thanks.

 

[NortonES2]

This one worked for us.

http://www.f-secure.com/v-descs/msblast.shtml

-------------------------------

If it doesn't leak oil it must be empty!!

 

[bilebalar]

Both Norton and Mcafee don't find any msblaster worm on my computer. Now it starts so slow. Also, I can't view the property in my EventViewer and Services.

Anyway I can just repair Services in Admin Tool in Control Panel?

Anything else I can do without reinstalling? Also, if I just reinstall the OS WITHOUT REFORMATTING THE HARDDRIVE, does this work?

Thanks.

 

[SQLBaby]

Wel, download this following utility, install it and it will show you all programes which are running behind the scene. Also if you whant to see where that programme (running behind the scene) is located then just click on view and then click on jump to... it will take you that directory or registery where that programme exist/run. Don't worry it work with all windows ver.

http://www.winxpnews.com/rd/rd.cfm?id=030812TI-Autorun

Knowledge is a key of success.

 

[bostonfrog]

I downloaded both the blasterfix.exe and patch from Microsoft. Norton's blasterfix.exe utility did find the blaster worm and removed it from the registry, or so it said in the log file. I don't fool around with the innards of Windows 2000 or the registry, since I don't understand them well and would not to risk ruining my computer. I don't know if anyone had the same experience I did: As long as you were connected to the internet, the clipboard didn't function, you couldn't print out web pages, and Javascript functions were disabled. I have a dial-up, and when I disconnected and started Windows up again, copy/paste worked fine. Incidentally, I was getting error messages using Microsoft Office -- Word and Access -- when I was online. Any additional comments are most appreciated.
-- Michel

 

[SQLBaby]

As i mentioned above, download and see what programmes are running in the back ground.

Knowledge is a key of success.

 

[bilebalar]

SQLBaby,

I downloaded the program, ran it and it didn't show anything msblaster program running in the background. If i go to PROCESS under TASK MANAGER, there's no msblaster either... So I am wondering if the worm is gone already. But new things happen... Now, I can view my files under WINNT/SYSTEM32 but I can't view anything using NOTEPAD. NOTEPAD is opened with the file shown on the bottom bar but when i click to enlarge to view the window, it won't enlarge.

My RPC service under SERVICES is disabled! And I can't start it! I click it but no window pop up but when I want to close SERVICES, it asks me to close all PROPERTY window first.

What to do? I have no sign of the msblaster files anywhere... not in my registry & not in my winnt/system folder. and norton removal tool and mcafee virus scan show up nothing.

Thanks.

 

[SQLBaby]

Bilebalar... see the following thread too, this thread is also right now in discussion in Win-XP Forum

thread779-629732



Knowledge is a key of success.

 

[bilebalar]

SQLBABY,

so from reading that thread, maybe my system is exploited, not infected. what can i do? will it clear up?

thanks.

 

[SQLBaby]

its better... all guys are technicaly perfect, try it. otherwise copy important data, format hard drive and reinstall every thing... its better than you waist more time for solution..... you know if you reinstall every thing, it will take just couple of hours.

Knowledge is a key of success.

 

[bilebalar]

Ok, say I have to do a reinstall.

Can I reinstall it over my existing copy? without losing my files? How about stuff in the DOCUMENT AND SETTING folder, will that be overwrote?

thanks.

 

[SQLBaby]

Yes you can, install it over previous one, but its better if you clean install now. Just copy your important documents and files to other computer and then format your hard drive and clean reinstall every thing

Knowledge is a key of success.

 

[bilebalar]

I can't copy anything. The PASTE buttom is always grey out.
I can't use my cd-rw either.

 

[SQLBaby]

Do you logn as Administrator....? Just copy your files to any other computer or if you have partion just copy on other part of hard drive, then format your C drive and reinstall Windows OS.

Knowledge is a key of success.

 

[bilebalar]

i can't paste anything or drag anything to another parition!
i am dead. i can't backup anything. i think i have to take the risk of reinstall without reformatting the harddrive. will this overwrite my DOCUMENT AND SETTING folder?

 

[SQLBaby]

no it will not over write on the documents but may be stting change. ok go ahead and reinstall it

Knowledge is a key of success.

 

[SQLBaby]

so what happend...? did you install ....?

Knowledge is a key of success.

 

[bostonfrog]

BileBalar,READ WHAT I SAID ABOUT THE CLIPBOARD FUNCTIONS!!! You do not need to reformat your hard drive or re-install Windows. The Copy | Paste functions are temporarily disabled but will come back when you've gotten rid of the worm. My PC worked normally after I logged off the internet and restarted the computer without being online again! But get rid of the virus by downloading the executables from Norton and Microsoft. It's a very strange program and I'm not really sure how it screws up Windows, but it IS recoverable.