Blaster Virus

[dsc]

On a laptop which is used at home i had problems when
accessing the Internet. The laptop kept shutting itself
down with a message saying something about NT Authority.
From the Internet i found that the laptop had been
infected by the Blaster virus.

I followed the procedure from Microsoft knowledge base to
eradicate it including updating XP with the fix that stops
this virus from infecting again and everythng seems ok, i
finished off running the fixit program that actually
deletes the virus. After this program had run it said it
had scanned over 21,000 files from the c: drive and
deleted 1 virus file. This seemed to fix the problem but
when i logged out and came back in on someone elses login
(profile) i got the same problem with the laptop shutting
it self down when on the Intenet.

I thought running the fixit program would have eradicated
the virus on the laptop iresptive of who was logged in as
the virus was deleted from the c: drive.

Does this mean i will have to repeat the steps i did for
the first user on the other 3 users who use this laptop ?

Thanks

Dsc

 

[Kelly]

Hi,

No, the removal should have been at Local_Machine level. For a second
opinion run my script. It will verify if your system is clean and will also
prompt you to install the latest update, if not installed.

To stop the reboots: Go to Start/Run and type in: services.msc. Scroll down
to Remote Procedure Call (RPC)/Recovery/First Failure/Restart the Service.

Close Windows Explorer, run the edit on line 257 which includes the prompt
for the patch once your system has been cleaned.

This script removes all variants of the W32.Blaster.Worm (original, B, C, D,
E and F) and will inform you whether or not the patch is already installed.
http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

More information here:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc