Printable View
Windows NT 4.0 Server Patch
Windows NT 4.0 Terminal Server Edition Patch
Windows 2000 Patch
Windows XP 32-bit Patch
Windows XP 64-bit Patch (I doubt any of you guys are using WinXP 64-bit)
Windows Server 2003 32-bit Patch
Windows Server 2003 64-bit patch (doubt anyone here's using this either :p )
SP1 won't fix the security hole, it's too old, and I'm too lazy to find it's download link too, just search the MS site yourself :p
Okay, I seem to have found the little barsteward responsible for the attack...
Search for "msblast.exe" and delete it. :D
Oh, and the guy who last attacked me with it was from Brazil. So there go my plans of destroying him :(
There are at least 15 EoFFers with this worm/virus/error thing. This virus isn't contagious, is it?
Latest problem: Symantec's lovely removal tool keeps giving me windows errors. Y'no, the ones where they want to send error reports and stuff. Gah. Twice now.
Maybe try McAfee's removal tool? I used the Symantec one and it worked well for me, but I'd imagine the McAfee one also works. Larger file, though; makes it a tricky download when you only have 5 minutes in which to download it!
Doesn't fix the security hole though, you could easily get reinfected :p Plus it doesn't undo registry changes and other stuff either :pQuote:
Search for "msblast.exe" and delete it.
The target the virus spreads from from an infected machine is random, although apparently it'll scan whole subnets at a time, so it's possible to spread fast, and is contagious in that manner, although not contagious in the sense that you catch it from visiting a site someone else that's infected is visiting :pQuote:
There are at least 15 EoFFers with this worm/virus/error thing. This virus isn't contagious, is it?
Good thing decent browsers like Opera know how to resume downloads :p Or use a non-infected machine e.g. linux to get it :pQuote:
Larger file, though; makes it a tricky download when you only have 5 minutes in which to download it!
Before anyone asks, no, it doesn't matter which tool you use, regardless of your virus scanner, the tools are standalone scanners and not part of the standard anti-virus kits.
I just went through the manual correction process with my parent's computer (mine's been spared thus far). I had no real problems. At first, things weren't working - I deleted the windows registry line, and the item in the cntrl alt delete processes list. A bit later, the bloody worm was back. Apparently when they say you have to download the patch first, then do the deletion process, they mean it. After following the instructions, everything is fine. I had assumed the patch only prevented getting it again, and I thought "what're the odds of that?" so I skipped that part of the instructions. Apparently, following *all* the instructions is the key to success.
Searching for msblast.exe on my computer finds nothing. Using one of those stand alone things that you linked to finds nothing. Yet I keep getting the error and my computer keeps restarting against my will!!!!
The patch still won't install, and I'm running out of patience.
Don't bother searching. Hit control alt delete and look at Processes. If MSBlast is in the list, you have this virus. Download the appropriate patch and install it. Then delete the MSBlast in your Processes list. Next go to Start in the bottom left hand corner. Go to Run. Type in regedit and hit ok. Look in the folder "HKEY_LOCAL_MACHINE", then "Software", "Microsoft", "Windows", "CurrentVersion" and finally "Run". In a list of stuff to the right, look for a line containing MSBlast. You might have to expand certain columns to see everything. Delete the line with MSBlast in it here too, and restart your computer. You should be all set. When downloading the patch, I recommend saving to disk instead of opening. Why? Because this virus gives you a very small window of opportunity to fix the problem before restarting. If you save the file, you'll have just enough time to finish saving it before it kicks you off. Then you can install the patch on your next computer restart.
Okay, I hit CTL ALT DEL and clicked the processes tab, and I see no MSBLAST.EXE... I'm really confused now...
EDIT: here's a screenshot of me getting the shutdown error along with showing my processes. No mention of msblast, unless it's something else in that list? (I'm not too good with computers unless it's the really basic stuff...)
I also get this error sometimes. Not every time. Once I close that, it goes immediately to the shut down error. If I leave it sit there, it will eventually go to the shut down error anyway.
I was having this problem... I just deleted msblast.exe (it's the infected file).
Things seem to be back to normal...
RSL, did you try this? It might at least stop your computer from restarting instantly so you can mess with it more. It's from this site: http://securityresponse.symantec.com...ster.worm.html
" * Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. There are at least two known ways to work around this, although neither solution works 100% of the time.
o If you run Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This may also work with other firewalls, although this has not been confirmed.
o In many cases, on both Windows 2000 and XP, changing settings for the Remote Call Procedure (RPC) Service may allow you to connect to the Internet without the computer shutting down. Follow these steps:
1. Do one of the following:
+ Windows 2000. Right-click the My Computer icon on the Windows desktop and then click Manage. The Computer Management window opens.
+ Windows XP. Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.
2. In the left pane, double-click Services and Applications and then select Services. A list of services appears.
3. In the right pane, locate the Remote Procedure Call (RPC) service.
CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two
4. Right-click the Remote Procedure Call (RPC) service and click Properties.
5. Click the Recovery tab.
6. Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
7. Click Apply and then OK"
Activating the firewall has stopped my computer from restarting. However, none of the suggestions in this thread have worked for me.
The two removal tools did not work. The McAffee one searched my entire computer and found nothing. The other one kept giving an error (probably the same thing that Loony BoB complained of.)
I downloaded the patch, but I've been unable to install it successfuly (refer to earlier post).
I've tried to go through windows updates, but it gives me an error there too.
I'll keep trying stuff. This has consumed all my free time the last two nights... at least it isn't restarting right now, but I want to get this fixed.
The error you get trying to install the Windows patch could just be due to some random suckiness of Windows and not the virus. Who knows. Did you try on the Symantec site, doing the manual removal? Going through step 1 to 5, starting with 1. Disabling System Restore (Windows XP). Especially the part where you edit your registry. Maybe running the tools already did delete all the files that were infected on your computer, or something. Just try all the steps (probably skipping step 2) and see if anything changes.