XP - Blaster nightmare

Villain

Ok I've being getting the blaster worm over and over again, I followed the instructions given in another thread here to remove and protect. They failed

I ran the microsoft update cd which installed the sp1 and the hotfixes and it was fine for 2 weeks but now my pc is shutting down everytime I go on the net again.

I ran stinger and it didn't find anything?

What next ???

Thanks for the help in advance.

Nick_oliveri

To quote whoever said it type;

shutdown-a

in start_run

Another option

Originally posted by Johnny Versace
Click Start > Run. The Run dialog box appears.
Type:

SERVICES.MSC /S

in the open line, and then click OK. The Services window opens.


In the right pane, locate the Remote Procedure Call (RPC) service.

---

CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

---

Right-click the Remote Procedure Call (RPC) service, and then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply, and then OK.

---

CAUTION: Make sure that you change these settings back once you have removed the worm (change "Restart the Service" back to "Restart the Computer".)

---

You then need to download the Blaster Virus removal tool. You can get it here -
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

...

Beware that the Blaster virus could be on your / or E:/ and is waiting to reinfect C.

Also, stop opening attachments from people you don't know, or anything that is not a ZIP or graphic or movie.

Another option;
Format your hard disk- backup the media on cd-r / dvd-r

Ste-

Are yoiu sure it's not sasser you have.
Have a read of it here
They say it could be the next blaster.

Villain

cheers guys, I think sasser could be the cause only started yesterday, i'l try running the removal tool when I get home. Thanks for the help

Stephen

more info on Sasser from MS: http://www.microsoft.com/security/incident/sasser.asp

If you installed the security updates they released a few weeks ago you will be unaffected by sasser. You'll also be unaffected if you use a firewall.

Zombrex

If you are running Windows XP as far as I know virus can survive in the System Restore files that Windows XP uses to back up the state of the system before installing new drivers.

Virus checkers cannot remove files from the Sytem Restore files because Windows XP blocks access to these file for security reasons (kinda ironic)

If you are getting a virus checker telling you have a virus, turn off System Restore (from Control Panel->System) and then run the virus checker again.

Sarky

Just returned home after three months to find my little brother has gone and gotten the computer infected, the fool. Grr...