probable virus, can't fix

[Mark Siltamaki]

I downloaded the MS patch for Blaster in the summer when I was infected, and
things were ok again. Now whenever I try to access Internet Explorer, My
Documents, My Computer, and others I get a message stating the program has
encountered a problem and needs to close and I am prompted to send an error
report to Microsoft. I sent the error message and followed a link to
Microsoft that allowed me to download some virus cleaners. A worm was found
(Nichi or Nachi or something) and cleaned. I was getting the RPC shutdown
thing and that has stopped, but I still can't access the aforementioned
programs. I can only get online here at Outlook Express, but can't follow
links to websites. I can access My Computer in safe mode but not Internet
Explorer. Any ideas?

Mark

 

[Carey Frisch [MVP]]

All too often, the penalty for not having a good antivirus program installed,
not enabling a firewall, and not downloading the critical updates
available from the Windows Update website, is an opportunity
to perform a "clean install" of your operating system.

I would suggest backing up your important documents and files
and proceed with a "clean install" of Windows XP:

The Windows XP CD is bootable and contains all the tools necessary
to partition and format your drive. Follow this procedure and allow
Windows XP to partition and format your drive:

NOTE: It would be best to physically disconnect all your peripheral hardware
devices, except for you mouse and keyboard, before installing XP.

1. Open your BIOS and set your CD Drive as the first bootable device.

===> Accessing Motherboard BIOS
===> http://www.michaelstevenstech.com/bios_manufacturer.htm

2. Insert your Windows XP CD in the CD Drive and reboot your computer.
3. You'll see a message to boot to the CD....follow the instructions.
4. The setup menu will appear and you should elect to delete the existing
Windows partitions, then create a new partition, then format the primary
partition (preferably NTFS) and proceed to install Windows XP.

5. Clean Install Windows XP
http://michaelstevenstech.com/cleanxpinstall.html

[Courtesy of Michael Stevens, MS-MVP]

6. After Windows XP is installed, visit the Windows Update website
and download the available "Critical Updates".

7. After installing the critical updates, be sure and visit the support website
of the manufacturer of the computer to download and install any
available Windows XP compatible drivers, such as video adapter
and audio drivers.

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------------------------


| I downloaded the MS patch for Blaster in the summer when I was infected, and
| things were ok again. Now whenever I try to access Internet Explorer, My
| Documents, My Computer, and others I get a message stating the program has
| encountered a problem and needs to close and I am prompted to send an error
| report to Microsoft. I sent the error message and followed a link to
| Microsoft that allowed me to download some virus cleaners. A worm was found
| (Nichi or Nachi or something) and cleaned. I was getting the RPC shutdown
| thing and that has stopped, but I still can't access the aforementioned
| programs. I can only get online here at Outlook Express, but can't follow
| links to websites. I can access My Computer in safe mode but not Internet
| Explorer. Any ideas?
|
| Mark

 

[Steve Nielsen]

Did you actually install the downloaded patch?

The reason I ask is that the RCP patch fixes the vulnerability that both
Blaster and Welchia (aka Nachi) worms exploit. So it is reasonable to
assume that you did not actually install the patch. Cleaning these worms
without installing the patch you just get re-infected with one or the
other (or a variant) almost immmediately upon connecting to the internet.

Steve