O/T - New Virus

[The Great Cornholio]

Just thought I'd let you know as I have an up to date virus checker and don't open strange attachments and have a firewall. (I work in IT Support)

If your Windows keeps giving an error relating to RPC and then rebooting - you've got it. This page tells you what to do :-

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html.

Hope no-one else gets it but I don't know how I did. . I don't think it's too much trouble - just tries to take over your machine and attempts a DoS on Windows Update to stop you fixing it.

 

[bigc]

hmmm, it seems to have stopped doing it for me now, it was doing it yesterday.
i dont know how i got it either,

 

[R2D2]

I'm having problems with this RPC also (Remote Procedure Call?)
When I click on your link Cornholio, it's saying file not found
Any ideas?

 

[The Great Cornholio]

I'm still trying to get rid of the damn thing. Here is the link again :-

securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Cut and paste should work on that.

 

[The Great Cornholio]

hmmm, it seems to have stopped doing it for me now, it was doing it yesterday.
i dont know how i got it either,

Check your running processes - if you've got a process called msblast.exe - your infected. And somebody is in to your machine!

 

[bigc]

i used the tool, i think its worked

 

[bigc]

it hasnt

and its about to reset again now

 

[The Great Cornholio]

If it's any consolation - we're not alone.

story.news.yahoo.com/news?tmpl=story&u=/nm/20030812/wr_nm/tech_windows_worm_dc_3

I've managed to install the patch but now it's killed my Norton Anti Virus.

 

[The Great Cornholio]

it hasnt

and its about to reset again now

You can stop the rebooting by going into Control Panel-Administrative Tools-Services. Find the Remote Procedure Call Service (Not the locator). Right Click on it and choose properties. Click on the recover tab and change 1st, 2nd and 3rd failures to restart service instead of Restart Computer. That gives you breathing time.

 

[Turkey]

This must be what Danny got. What there are in this world.

 

[The Great Cornholio]

Apparently doesn't cause much damage but is an absolute pig to get rid of. I had to disable System Restore, install the Microsoft Patch manually as Automatic Update doesn't work, remove Norton Anti Virus and install the free AVG software. That's now running a full sweep so hopefully I'll be rid of it soon but the little that wrote it better stay out of my way for a while.

 

[bigc]

You can stop the rebooting by going into Control Panel-Administrative Tools-Services. Find the Remote Procedure Call Service (Not the locator). Right Click on it and choose properties. Click on the recover tab and change 1st, 2nd and 3rd failures to restart service instead of Restart Computer. That gives you breathing time.

how did you remove it? just by running the program? did you disable system restore?

 

[Seagullible]

Have to laugh at Amazon.co.uk, the occupy the offices below us and someones downloaded a virus so there all running round like headless chickens trying to stop people logging on. Have to laugh as they're freaks of nature...
... wonder if Dwayne and Twatty work there

 

[The Great Cornholio]

how did you remove it? just by running the program? did you disable system restore?

Running the .asp file from Microsoft closes the hole and should stop it causing any problems. To stop it running, you need to End Task the msblast.exe process. Delete msblast.exe from /windows/system32 and remove the registry entry as described on the above link. That seems to have stopped it for me. But if your Anti Virus software still works, update the reference files and let that sort it out. Didn't work for me as it killed by Anti Virus Software. You'll need to run Anti Virus at some stage anyway to remove the infected file and to stop it spreading to other users.

Good luck!

 

[The Great Cornholio]

Ahhhhh! Just twigged what happened. Installing Norton Security has disabled my firewall somehow. That's got to be a problem under the trades descriptions act. Installing Security software has made my machine less secure.

 

[bigc]

thats a farce!

 

[bigc]

how do you start windows xp up in safe mode? i knew for 95/98/ME but i've never needed to start XP up in it

(the remover tool can only remove the msblast.exe program in safe mode, thats why i need it)

 

[Cian]

hehe, I have the best virus protection known to any A/V company - Don't use a mainstream operating system. The "Big Three" are all to damn dangerous these days.

Doesn't stop Microsoft, yes that Microsoft, from maving "R AntiVirus" for the OS i use though.... doubt they sell many copies.

 

[Cian]

how do you start windows xp up in safe mode? i knew for 95/98/ME but i've never needed to start XP up in it

(the remover tool can only remove the msblast.exe program in safe mode, thats why i need it)

erk, I'm double posting...

AFAIK you hold Shift while booting but note I use Windows very infrequently.

However you can just half-boot the machine, kill the power, and boot it again and you are 100% sure to get the menu. Although i'm not responsible if that murders your harddrive(s).

 

[The Great Cornholio]

how do you start windows xp up in safe mode? i knew for 95/98/ME but i've never needed to start XP up in it

(the remover tool can only remove the msblast.exe program in safe mode, thats why i need it)

Hold down F8 just after the POST test. It should give you a massive list of boot options - Safe Mode being one of them.