Jeanne
Fri Aug 15 14:00:15 CDT 2003
Pavan,
Thanks again, I will try this when I get home...the only
one that looks like it might be is the Nstask32.exe...If
I do recall that one might have been in my msconfig...I'm
sure the others weren't. I'll give you a holler if I
need anymore help :-) If this doesn't work, I think I'm
going to send it down to my tech and have him re-install
XP, it's about time I did that anyways :-)
Jeanne
>-----Original Message-----
>Jeanne,
> As of August 14, 2003, several variants of the original
worm have been
>confirmed that use different file names. Follow these
steps to also search
>for files that are named Nstask32.exe, Penis32.exe,
Teekids.exe,
>Winlogin.exe, Win32sockdrv.dll, and Yuetyutr.dll. If any
of these files are
>found, contact your antivirus software vendor for
removal information. For
>additional information about these variants, see the
following Symantec
>Corporation Web sites:
> a.. W32.Blaster.C.Worm: Teekids.exe
>
http://www.sarc.com/avcenter/venc/data/w32.blaster.c.worm.
html
>
> b.. W32.Blaster.B.Worm: Penis32.exe
>
http://www.sarc.com/avcenter/venc/data/w32.blaster.b.worm.
html
>
> c.. W32.Randex.E : Nstask32.exe, Winlogin.exe,
Win32sockdrv.dll, or
>Yyuetyutr.dll
>
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.randex.e.html
>
>Pavan
>
>"Jeanne" <jeannemurie@nemontel.net> wrote in message
>news:047e01c36336$8595b2b0$a001280a@phx.gbl...
>> Pavan,
>>
>> I've done all of this but after step 6 I can go no
>> farther. As you will notice in my first post there IS
>> NOT A msblast.exe in my processes or msconfig, non in
my
>> registry nothing, it will not show up. Any more ideas?
I
>> know I have it as my RPC will shut down my computer and
>> that my norton warning box will pop up a couple of
times
>> to tell me I am infected with the msblast.exe but
norton
>> scan and the fixblast tool will not pick up the
>> virus...frustrating! If you would please e-mail me
>> privately. jeannemurie@nemontel.net
>>
>> Jeanne
>> >-----Original Message-----
>> >"If you are infected by a Virus:
>> >
>> > 1.. Disconnect your PC from the internet
>> > 2.. We need to stop the RPC service restarting the
PC,
>> click HERE for a
>> >visual walkthrough of how to do it or, click START,
and
>> then RUN. Type in
>> >SERVICES.MSC and click OK
>> > 3.. Scroll down for the Remote Procedure Call (RPC)
>> service and double
>> >click it
>> > 4.. Now click on the RECOVERY tab
>> > 5.. In the FIRST FAILURE, SECOND FAILURE and
>> SUBSEQUENT FAILURE drop down
>> >boxes, choose TAKE NO ACTION. Now click OK. Your PC
will
>> now stay turned on
>> >should the RPC crash
>> > 6.. Download a firewall. If you don't have one,
>> Visualante can point you
>> >in the direction of a few good free ones HERE. The
>> Windows XP firewall
>> >doesn't appear to be very affective against this. You
>> can go online now and
>> >not worry about the PC shutting down. If you already
>> have a firewall, click
>> >HERE to see how to configure it to block these attacks
>> > 7.. Click on START, then RUN and then type in
>> MSCONFIG. Click OK
>> > 8.. Click on the STARTUP tab at the top. Look for
>> WINDOWS AUTO UPDATER or
>> >MSBLAST.EXE and click the tick next to it to stop it
>> running. Now click OK
>> > 9.. Restart your PC
>> > 10.. Click on START, and then RUN, type in REGEDIT
>> > 11.. On the new window, click on EDIT and then FIND.
>> Type in MSBLAST* and
>> >click FIND NEXT
>> > 12.. As soon as the search finds an entry, press the
>> DELETE key and remove
>> >it
>> > 13.. On your hard drive, go to C:\WINDOWS\SYSTEM32
and
>> remove the
>> >MSBLAST.EXE* file "
>> >------ From
http://www.visualante.org/msblast/
>> >
>> >Visit:
>>
http://v4.windowsupdate.microsoft.com/en/default.asp
>> >
>> >
>> >
>> >For more Information Visit
>>
http://www.visualante.org/msblast/
>> >
>> >"Jeanne" <jeannemurie@nemontel.net> wrote in message
>> >news:01c301c36291$49482270$a401280a@phx.gbl...
>> >> Or maybe this is normal...I have and have always
had my
>> >> norton up to date for live up date. Then my
comptuer
>> >> pops up with the 'red alert' box from norton that my
>> >> computer is infected with the blaster worm. I
cannot
>> >> quarantine or anything, only can hit ok. This will
>> always
>> >> pop up twice in a row. Then I do a system scan in
all
>> >> files for a virus, and it won't show up, I've
>> downloaded
>> >> the fixblast tool from norton to fix it and it says
my
>> >> computer is not infected. After connecting to the
>> >> interent my machine gives me the 1 min countdown to
>> >> restart. I have since turned my RPC to not restart
my
>> >> computer but to restart the service if it's
interuppted
>> >> so I could get the patch put on. Also in my
processes
>> the
>> >> msblast.exe doesn't show up and my registry doesn't
>> have
>> >> the added key to run the ms blast. My question is
how
>> >> the heck do I get rid of it? Am I going to have to
>> >> completely reinstall my XP?
>> >> Thanks for any help!
>> >> Jeanne
>> >>
>> >
>> >
>> >.
>> >
>
>
>.
>