Hi Rob, you may have Blaster! Check out the following information to see if
it is relevant to you:
http://www.microsoft.com/security/incident/blast_faq.asp
Blaster Worm FAQ
http://www.f-prot.com/news/vir_alert/msblast.html#reaction_b_and_c
New W32/Msblast variants: W32/Msblast.B and W32/Msblast.C
1. CTRL-ALT-DELETE to bring up the Task Manager. Look for msblast.exe and
select it and End Process. This will stop the computer from shutting down.
It doesn't remove the worm.
To enable your firewall :
- Click Start
- Click Control Panel
- Double Click "Network Connections"
- Right-click on your Dial up Connection, then left click 'Properties'
- Left Click 'Advanced' Under "Internet Connection Firewall" tick the box
'Protect my computer and networking by limiting or preventing access to this
computer from the internet'
- Click Ok and Close the "network connections" box.
You can then connect to the Internet and download the Microsoft relevant
patch.
You could also try:
Click Start/Run then type in cmd
and then type in : shutdown -a
Do this when the shutdown prompt appears.
W32.Blaster.Worm patch is available here:-
If you're not sure if the patch is installed it is No: 823980, Look in your
Add/Remove Programs for the Hotfix to see if it is installed otherwise
download it from here:
www.microsoft.com.au/blasterhelp
You must download and install the patch. In many cases, you will need to do
this before you can continue with the removal of the worm.
Because of the way the worm works, it may be difficult to connect to the
Internet to obtain the patch, definitions, or removal tool before the worm
shuts down the computer. It has been reported that, for users of Windows XP,
activating the Windows XP firewall may allow you to download and install the
patch, obtain virus definitions, and run the removal tool. This may also
work with other firewalls, although this has not been confirmed.
2. You can download the Symantec Removal Tool from here
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
or you can visit this site to assist in the removal of the worm
http://www3.ca.com/virusinfo/virus.aspx?ID=36265
To download ClnPoza.zip - a utility that cleans a local machine affected by
Win32.Poza,
or this site for assistance:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc
Panda Software also provides a free application especially designed to
detect and eliminate the Blaster worm and repair the damage that it may have
caused in affected computers. This utility is available for download at
http://www.pandasoftware.com/download/utilities/.
W32/Blaster-A disinfection instructions and FAQ
http://www.sophos.com/support/disinfection/blastera.html#3
F-Secure Virus Descriptions
http://www.f-secure.com/v-descs/msblast.shtml
http://www.updatexp.com/cryptographic-service.html
For information on the Cryptographic Services
