rpc restart worm and how to fix it

[jeff]

1)start pc in safe mode
2)start--->run--->regedit--->hkey_local
machine\software\microsoft\current version\run
3)look for an entry that says windows auto
update="msblast.exe" delete this entry, close regedit
4)open run--->msconfig--->disable anything that says
msblast.exe
5)restart into normal mode and go to
http://housecall.antivirus.com and do a full scan

 

[jeff]

i would only install the patch after the system is cleaned
but yes also the path in the registry is wrong to make it
faster just do a data and value search in the registry
instead since it is now showing up in 2 different
places...whee! it's all mine!

 

[Jeff]

I have this problem too, I did find the "msblast.exe"
entry in the registry, but not anywhere alse. Which patch
should I install???

 

[jeff]

if you do a normal windows update it will install it but
only do it after you have cleaned your system with an anti-
virus..

 

[Matt DuBois [MSFT]]

If you go to windowsupdate.microsoft.com the fix for this issue is the one
labeled 823980. However, it along with all the other critical updates will
be selected automatically, so all you need to do is go to the site, select
"Scan for updates", then "Review and Install updates". If you do not have
SP1 installed already, then it would be easiest to install that first, then
come back and get the rest of the updates after SP1 is installed.
DEFINITELY enable a firewall, as Jupiter suggests, before you connect it to
the internet again though. Windows Update will work just fine with the
firewall enabled.

 

[fcabanski]

Two problems:

I can't dl the patch because the system shuts down within
a minute of being online.

I can't scan the system or clean a virus because my
McAfee is an online scan, and the system shuts down
within a minute of being online.

I have cleaned the msblast everywhere, but it keeps
coming back and the system won't stay online long enough
to do anything about it.