computer shuting down and restarting, error message

[cheryl]

when I start my maching using msn.com or at times not
even getting on internet. computer gives me warning it
will shut down in 60 seconds error message reads [TRD
ww.C:\Windows\system 32\msbl] and is followed by a screen
saying {NT Athority System 32} help please.

 

[Gary Thorn [MVP-Windows Technologies/Xbox]]

-----Original Message-----
when I start my maching using msn.com or at times not
even getting on internet. computer gives me warning it
will shut down in 60 seconds error message reads [TRD
ww.C:\Windows\system 32\msbl] and is followed by a screen
saying {NT Athority System 32} help please.
.

This a virus called w32.Blaster.Worm

Patch from Microsoft:
http://tinyurl.com/h84v
More info from MS:
www.microsoft.com/security/incident/blast.asp

-------------------------------

From Symantec Security Response for the virus
w32.Blaster.Worm:
http://tinyurl.com/jozm

-------------------------------

From Kelly - MVP:
Close Windows Explorer, End Process in the Task Manager
for msblast.exe, run
the edit on line 257 then run the patch listed below it:
http://www.kellys-korner-xp.com/xp_tweaks.htm

Windows XP Security Patch: Buffer Overrun In RPC Interface
Could Allow Code
Execution: http://tinyurl.com/ir5h

More information here:
www.kellys-korner-xp.com/xp_qr.htm#rpc

-------------------------------

Install a firewall (software like or hardware like router)
to help prevent future similar issues.

Most users will be using the 32 bit edition of WinXP Home
and Pro.


Hope this helps!

Gary Thorn
MVP-Windows Technologies/Xbox
Associate Expert


More about the Windows XP Expert Zone:


More about the MS MVP Program:
http://tinyurl.com/n08

 

[Gary Thorn [MVP-Windows Technologies/Xbox]]

-----Original Message-----
when I start my maching using msn.com or at times not
even getting on internet. computer gives me warning it
will shut down in 60 seconds error message reads [TRD
ww.C:\Windows\system 32\msbl] and is followed by a screen
saying {NT Athority System 32} help please.
.

This a virus called w32.Blaster.Worm

Patch from Microsoft:
http://tinyurl.com/h84v
More info from MS:
www.microsoft.com/security/incident/blast.asp

-------------------------------

From Symantec Security Response for the virus
w32.Blaster.Worm:
http://tinyurl.com/jozm

-------------------------------

From Kelly - MVP:
Close Windows Explorer, End Process in the Task Manager
for msblast.exe, run
the edit on line 257 then run the patch listed below it:
http://www.kellys-korner-xp.com/xp_tweaks.htm

Windows XP Security Patch: Buffer Overrun In RPC Interface
Could Allow Code
Execution: http://tinyurl.com/ir5h

More information here:
www.kellys-korner-xp.com/xp_qr.htm#rpc

-------------------------------

Install a firewall (software like or hardware like router)
to help prevent future similar issues.

Most users will be using the 32 bit edition of WinXP Home
and Pro.


Hope this helps!

Gary Thorn
MVP-Windows Technologies/Xbox
Associate Expert


More about the Windows XP Expert Zone:


More about the MS MVP Program:
http://tinyurl.com/n08

 

[Kim]

Cheyl, Kelly all other newbies

All of you out there experiencing your computers shutting
down automatically ..have been attacked by the
W32.Blaster.Worm. (also known as W32LovSan.worm) You need
to run a removal too. You can get it at www.Symantec.com

http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html

Also at Mcafee or sophos.

But if running XP. You must turn off system restore. Go
to my computer, right click on properties. Go to system
restore tab. Check the box that says
turn OFF system restore.

To make it easier ... disconnect from the network or pull
out your internet connection while you are doing this.
This will give and error and stop the TFTP and
msblast.exe goes idle.

After you get the thing removed, then you can appy the
microsoft patch MS03-026 (kb823980). You wont be able
too before because the worm has a denial of service
attack when you try to do the update.

You also can remae the file TFTP.exe for extra
protection. Rename to something like (tftp_exe.old).
This is not used for anything and is a very vunerable
file transfer protocol. Dont delte it though in case you
might have a future need for it .

Hope this helps
Kim