Virus problems

[Jon Pershke]

I have been struggling w/ virus's for a week w/ the
following history/symptoms.

1) Rundll32.exe problems which I fixed via KB#812340,
however, only AFTER I reinstalled XP at one of my darker
moments (I worry XP might not have installed properly as
several errors popped up in installation related to the
rundll problem I expect)
2) Blaster problems in enbiei.exe file which Norton
didn't fix but I finally fixed it w/ fixblast.exe
3) Because I reinstalled XP, I had to try to get all the
downloads....kept getting "generic host" errors even
after I ensured blaster was gone via 2.
4) Got both the blaster patch and Service Patch 1
downloaded and installed.

Now....some executables shutdown after a few seconds (ie.
Norton) and I get the "new updates are ready to download"
icons building up on my menu bar....one pops up about
every 15 seconds.....



Any suggestions, please email me at (e-mail address removed).

thanks,

 

[Paul [MSFT]]

Regarding your post:
--------------------
| From: "Jon Pershke" <[email protected]>
| Subject: Virus problems
| Date: Sun, 18 Jan 2004 10:42:51 -0800
|
| I have been struggling w/ virus's for a week w/ the
| following history/symptoms.
|
| 1) Rundll32.exe problems which I fixed via KB#812340,
| however, only AFTER I reinstalled XP at one of my darker
| moments (I worry XP might not have installed properly as
| several errors popped up in installation related to the
| rundll problem I expect)
|
| 2) Blaster problems in enbiei.exe file which Norton
| didn't fix but I finally fixed it w/ fixblast.exe
|
| 3) Because I reinstalled XP, I had to try to get all the
| downloads....kept getting "generic host" errors even
| after I ensured blaster was gone via 2.
|
| 4) Got both the blaster patch and Service Patch 1
| downloaded and installed.
|
| Now....some executables shutdown after a few seconds (ie.
| Norton) and I get the "new updates are ready to download"
| icons building up on my menu bar....one pops up about
| every 15 seconds.....

| Any suggestions, please email me at (e-mail address removed).
|
| thanks,

Hi Jon,

1. The Microsoft web site dedicated to the blaster virus may provide
additional steps you can use:
http://www.microsoft.com/security/incident/blast.asp

2. Microsoft recently released a critical update called the Blaster Removal
tool. If you are infected and visit the Windows Update site, WU will scan
your system and offer you the blaster removal tool to download and run.

3. Microsoft also hav additional information on computer Viruses:
Description, Prevention and Recovery:
http://support.microsoft.com/default.aspx?scid=kb;en-us;129972

Finally, resolving this may require some active troubleshooting with a
security specialist on the phone. If you want to try this, please contact
Microsoft Product Support for additional steps:

For free virus-related support in the U.S. or Canada, call (866) PC-SAFETY
(727-2338). If you are outside the U.S. or Canada, contact your local
Microsoft subsidiary.

=========

This posting is provided "AS IS" with no warranties, and confers no rights.

Windows XP Security Homepage:
http://www.microsoft.com/windowsxp/security/default.asp

Windows 2000 Security Homepage:
http://www.microsoft.com/windows2000/security/default.asp

Top 10 Windows Newsgroups Security Questions:
http://www.microsoft.com/technet/newsgroups/default.asp?url=/technet/newsgro
ups/nodepages/sectop10.asp

=========
Paul Hayes, MCSE
Product Support Services
Microsoft Corporation
(e-mail address removed)

 

[Jon]

-----Original Message-----

Regarding your post:
--------------------
| From: "Jon Pershke" <[email protected]>
| Subject: Virus problems
| Date: Sun, 18 Jan 2004 10:42:51 -0800
|
| I have been struggling w/ virus's for a week w/ the
| following history/symptoms.
|
| 1) Rundll32.exe problems which I fixed via KB#812340,
| however, only AFTER I reinstalled XP at one of my darker
| moments (I worry XP might not have installed properly as
| several errors popped up in installation related to the
| rundll problem I expect)
|
| 2) Blaster problems in enbiei.exe file which Norton
| didn't fix but I finally fixed it w/ fixblast.exe
|
| 3) Because I reinstalled XP, I had to try to get all the
| downloads....kept getting "generic host" errors even
| after I ensured blaster was gone via 2.
|
| 4) Got both the blaster patch and Service Patch 1
| downloaded and installed.
|
| Now....some executables shutdown after a few seconds (ie.
| Norton) and I get the "new updates are ready to download"
| icons building up on my menu bar....one pops up about
| every 15 seconds.....

| Any suggestions, please email me at (e-mail address removed).
|
| thanks,

Hi Jon,

1. The Microsoft web site dedicated to the blaster virus may provide
additional steps you can use:
http://www.microsoft.com/security/incident/blast.asp

2. Microsoft recently released a critical update called the Blaster Removal
tool. If you are infected and visit the Windows Update site, WU will scan
your system and offer you the blaster removal tool to download and run.

3. Microsoft also hav additional information on computer Viruses:
Description, Prevention and Recovery:
http://support.microsoft.com/default.aspx?scid=kb;en- us;129972

Finally, resolving this may require some active troubleshooting with a
security specialist on the phone. If you want to try this, please contact
Microsoft Product Support for additional steps:

For free virus-related support in the U.S. or Canada, call (866) PC-SAFETY
(727-2338). If you are outside the U.S. or Canada, contact your local
Microsoft subsidiary.

=========

This posting is provided "AS IS" with no warranties, and confers no rights.

Windows XP Security Homepage:
http://www.microsoft.com/windowsxp/security/default.asp

Windows 2000 Security Homepage:
http://www.microsoft.com/windows2000/security/default.asp

Top 10 Windows Newsgroups Security Questions:
http://www.microsoft.com/technet/newsgroups/default.asp? url=/technet/newsgro
ups/nodepages/sectop10.asp

=========
Paul Hayes, MCSE
Product Support Services
Microsoft Corporation
(e-mail address removed)

.Thanks for the info. I have done everything anyone has

ever written re: blaster. I have some new info. It
appears that the problem is now something related
to "ipstack".

Ipstack.exe takes over most of my system resources AND
shuts down Norton after a few seconds. I can't find
anything on this in microsft pages but a google search
seems to imply that this is a new strain of virus that
Norton isn't yet picking up (in fact Norton runs clean in
Safe mode)

Any additional thoughts?

 

[sambo]

Hi Jon.

I recently had exactly the same problem as you. I did, however
successfully get rid of it. If you're wanting to delete it, here's wha
you do:

1) Download HijackThis from: http://tinyurl.com/yslp

2) run HijackThis (making sure everything else is closed) and clic
"Scan". This will come up with a list of things. Scroll down to th
titles starting with "04\HKLM\..\run:". There will be two titles i
here containing "ipstack" somewhere in their name. Check the boxes nex
to these, and click "Fix Checked".

3) Reboot your computer in safe-mode. Now if you're on XP this can b
the trickey bit, becuase you'll have to open msconfig, which will clos
after a few seconds, so you have to work fast. Heres some instruction
for this step:
http://tinyurl.com/3px9

4) Once in safe-mode, you can now delete the ipstack files. There ar
two of them to get rid of - one will be located in WINDOWS\system32 -
can't recall the exact name of this file, but it started with "ipsatck
and was followed by a series of numbers. The second file is i
WINDOWS\Prefetch - this one should be "ipstack.exe".

5) Once you've empties these from the recycle bin, you can reboot you
computer in normal mode again, and hey-presto! if you did everythin
right, it should be gone.

Hope this helps you
-
samb