Msblaster

[Rob]

Got the blaster virus, used norton tool to remove. Scan
checks clean but I still get the RPC overrun system will
shut down in 60 seconds dialog box. Any ideas?

 

[Chris Lanier]

You have to install the patch for Windows.

Removal info at...
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

More info about the worm:
http://www.microsoft.com/security/incident/blast.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[karen]

hi Rob,
its a real pest. Ok when you removed blast did you use
the fix tool?
Http://security.symantec.com/avcenter/fixBlast.exe.
You will also find files hiding in registry Editor,
delete msblast. To get there : start/run..type in
regedit, go to file and find. Type in msblast.exe, and it
will find it)
Also it hides in a folder in C:\ windows, called
prefetch...delete msblast.exe from the folder.
Thats about all i can tell you rob, but i am now free
from blast.
DO NOT.....download microsoft tools, they are infected.
Always use symantec/norton.
Good luck.
Any probs please email me, i have cured a few more than
blast, lol. I can come in your pc via remote assistance
and help you.

 

[=?iso-8859-15?Q?Svein_Morten_Rougn=F8?=]

Got the blaster virus, used norton tool to remove. Scan checks clean but
I still get the RPC overrun system will shut down in 60 seconds dialog
box. Any ideas?

Even if you get the shutdown message you are probably NOT infected. The RPC
service tends to terminate when the Blaster virus TRIES to infect your
computer. This misconception causes people to gravely overestimate how many
computers are infected with Blaster.

I administer over a hundred computers with Windows XP. Many of these run
automatic updates, but almost all the computers whithout the necessary
update got the shutdown message.

After scanning about ten computers for the Blaster virus WITHOUT finding it
I concluded they had never been infected. Other infected computers had
simply TRIED to infect them. And yes, I used several removal tools for the
Blaster virus and as soon as Symantec and Computer Associates produced
updates for their respective antivirus softwares, I also did a full virus
scan on several computers without finding a thing.

So what do you do?

1.
Activate the Windows XP firewall.

2.
Run Windows Update.

This is basically what Microsoft has now put on the Windows Update page,
except they provide links to download the one patch which fixes the RPC
vulnerability. This is enough to stop the Blaster virus, but I recommend
using Windows Update to download ALL updates (always).

Also, if you haven't got a decent antivirus software, GET IT! And keep it
updated!

--
Svein Morten Rougnø
IT-administrator
Vestfold University College, Norway

E-mail:
Svein dot M dot Rougno att hive dot no

 

[Ron Martell]

Got the blaster virus, used norton tool to remove. Scan
checks clean but I still get the RPC overrun system will
shut down in 60 seconds dialog box. Any ideas?

Use Doug Knox's Blaster removal script:
www.kellys-korner-xp.com/xp_tweaks.htm, Line 257, Left Column, Remote
Procedure Call Worm.

The procedure should be:

1. Download the MS03-026 patch
2. Download the script.
3. Disconnect from the Internet. Unplug Cable/DSL modem if you have
one. That prevents reinfection during the time interval between
running the script and the completion of the patch installation.
4. Run the script.
5. Install the patch.
6. Reconnect to the Internet. Update your antivirus software and do
a complete scan.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."