help with worm

CrazyAzorean · Jan 20, 2004, 03:45 AM

Anyone can help me, i want to eliminate the "msblast" from my Pc (not the one i'm using now)
because of him i can't get on-line.
Any sugestions, E-mail them to marct@iol.pt

zerodamage · Jan 20, 2004, 03:54 AM

Well the first thing you need to do is disable DCOM before the 60 seconds is up. I do that by going to GRC.com and downloading the Dcombobulator program. It fits on a floppy and you can do it as soon as XP or Win2k boots up. Then reboot and go to Symantecs site and get the msblast removal tool.

As soon as that is done, go to WINDOWS UPDATE and update your windows.

Dyre Straits · Jan 20, 2004, 03:58 AM

Hi,

You'll have to post more about that computer....

What OS? for instance.

Also, Feedback isn't the correct post for this type of question. Better to ask it in the Technical forum.

CrazyAzorean · Jan 20, 2004, 04:21 AM

windows XP pro

Davidgt · Jan 20, 2004, 04:37 AM

If you turn on winxp firewall It disables DCOM then go to windows update get all the updates thenreboot disable windows firewall

Davidgt · Jan 20, 2004, 04:42 AM

or just grab this

http://securityresponse.symantec.com...r/FixBlast.exe

notes:

Download the FixBlast.exe file from:

http://securityresponse.symantec.com...r/FixBlast.exe

Save the file to a convenient location, such as your downloads folder or the Windows Desktop (or removable media that is known to be uninfected, if possible).
To check the authenticity of the digital signature, refer to the section, "Digital signature."
Close all the running programs before running the tool.
If you are running Windows XP, then disable System Restore. Refer to the section, "System Restore option in Windows Me/XP," for additional details.

CAUTION: If you are running Windows XP, we strongly recommend that you do not skip this step. The removal procedure may be unsuccessful if Windows XP System Restore is not disabled, because Windows prevents outside programs from modifying System Restore.
--------------------------------------------------------------------------------

Double-click the FixBlast.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.

--------------------------------------------------------------------------------
Note: If, when running the tool, you see a message that the tool was not able to remove one or more files, run the tool in Safe mode. Shut down the computer, turn off the power, and wait 30 seconds. Restart the computer in Safe mode and then run the tool again. All the Windows 32-bit operating systems, except Windows NT, can be restarted in Safe mode. For instructions, read the document "How to start the computer in Safe Mode."
--------------------------------------------------------------------------------

Restart the computer.
Run the removal tool again to ensure that the system is clean.
If you are running Windows XP, then re-enable System Restore.
Run LiveUpdate to make sure that you are using the most current virus definitions.

When the tool has finished running, you will see a message indicating whether W32.Blaster.Worm infected the computer. In the case of a worm removal, the program displays the following results:
Total number of the scanned files
Number of deleted files
Number of terminated viral processes
Number of fixed registry entries

CrazyAzorean · Jan 20, 2004, 05:36 AM

thanks for your help, i'll try it tomorrow

:d

zerodamage · Jan 20, 2004, 06:28 PM

Well remember as long as you have that msblast on your computer and you are online with it, you are infecting other computers on the net. I encourage you to keep it off until you are ready to remove msblast.

The_Neon_Cowboy · Jan 21, 2004, 03:43 AM

This is why you should either turn auto updating or visit the windows update website religiously.

Jan 20, 2004, 03:45 AM	#1
CrazyAzorean DriverHeaven Junior Member Join Date: Jan 2004 Location: Azores, Portugal Posts: 67 Rep Power: 0	help with worm Anyone can help me, i want to eliminate the "msblast" from my Pc (not the one i'm using now) because of him i can't get on-line. Any sugestions, E-mail them to marct@iol.pt

Jan 20, 2004, 04:21 AM	Thread Starter #4
CrazyAzorean DriverHeaven Junior Member Join Date: Jan 2004 Location: Azores, Portugal Posts: 67 Rep Power: 0	windows XP pro __________________ Every man is respossible for is own destiny

Jan 20, 2004, 04:37 AM	#5
Davidgt Car Audio Guy Join Date: Jul 2003 Location: Atlanta, Ga Posts: 499 Rep Power: 0	If you turn on winxp firewall It disables DCOM then go to windows update get all the updates thenreboot disable windows firewall __________________ Sales/Support Manager Taraautosound.com wonderful sig by tastyweat

Jan 20, 2004, 04:42 AM	#6
Davidgt Car Audio Guy Join Date: Jul 2003 Location: Atlanta, Ga Posts: 499 Rep Power: 0	or just grab this http://securityresponse.symantec.com...r/FixBlast.exe notes: Download the FixBlast.exe file from: http://securityresponse.symantec.com...r/FixBlast.exe Save the file to a convenient location, such as your downloads folder or the Windows Desktop (or removable media that is known to be uninfected, if possible). To check the authenticity of the digital signature, refer to the section, "Digital signature." Close all the running programs before running the tool. If you are running Windows XP, then disable System Restore. Refer to the section, "System Restore option in Windows Me/XP," for additional details. CAUTION: If you are running Windows XP, we strongly recommend that you do not skip this step. The removal procedure may be unsuccessful if Windows XP System Restore is not disabled, because Windows prevents outside programs from modifying System Restore. -------------------------------------------------------------------------------- Double-click the FixBlast.exe file to start the removal tool. Click Start to begin the process, and then allow the tool to run. -------------------------------------------------------------------------------- Note: If, when running the tool, you see a message that the tool was not able to remove one or more files, run the tool in Safe mode. Shut down the computer, turn off the power, and wait 30 seconds. Restart the computer in Safe mode and then run the tool again. All the Windows 32-bit operating systems, except Windows NT, can be restarted in Safe mode. For instructions, read the document "How to start the computer in Safe Mode." -------------------------------------------------------------------------------- Restart the computer. Run the removal tool again to ensure that the system is clean. If you are running Windows XP, then re-enable System Restore. Run LiveUpdate to make sure that you are using the most current virus definitions. When the tool has finished running, you will see a message indicating whether W32.Blaster.Worm infected the computer. In the case of a worm removal, the program displays the following results: Total number of the scanned files Number of deleted files Number of terminated viral processes Number of fixed registry entries __________________ Sales/Support Manager Taraautosound.com wonderful sig by tastyweat

Jan 21, 2004, 03:43 AM	#9
The_Neon_Cowboy HardwareHeaven Extreme Member Join Date: Dec 2002 Location: U.S.A. Posts: 16,009 Rep Power: 92 System Specs	This is why you should either turn auto updating or visit the windows update website religiously. __________________

Jan 20, 2004, 03:54 AM	#2
zerodamage HardwareHeaven Extreme Member Join Date: May 2003 Location: Virginia, USA Posts: 3,478 Rep Power: 0 System Specs	Well the first thing you need to do is disable DCOM before the 60 seconds is up. I do that by going to GRC.com and downloading the Dcombobulator program. It fits on a floppy and you can do it as soon as XP or Win2k boots up. Then reboot and go to Symantecs site and get the msblast removal tool. As soon as that is done, go to WINDOWS UPDATE and update your windows.

Jan 20, 2004, 05:36 AM	Thread Starter #7
CrazyAzorean DriverHeaven Junior Member Join Date: Jan 2004 Location: Azores, Portugal Posts: 67 Rep Power: 0	thanks for your help, i'll try it tomorrow :d

Jan 20, 2004, 06:28 PM	#8
zerodamage HardwareHeaven Extreme Member Join Date: May 2003 Location: Virginia, USA Posts: 3,478 Rep Power: 0 System Specs	Well remember as long as you have that msblast on your computer and you are online with it, you are infecting other computers on the net. I encourage you to keep it off until you are ready to remove msblast.