Win XP RPC Service Failure Reboot Rant Help - the story of a ruined weekend!

[Bill Gribble]

Quite a long, complicated story as much to blow off steam as anything
else, though any help, sympathy or advice would be much appreciated.
Judging from related threads that I've read here I'm not the first to
fall foul of this particular problem...

If nothing else, this is an anecdote of why it's so necessary to keep
your OS patched up, a decent anti-virus package installed, actively
scanning and totally up to date, and your Internet connection completely
firewalled.

Began sometime last week with the decision to upgrade my existing copy
of Windows ME to XP Home Edition and install Symantec Internet Security
2004.

The catalyst for this decision was my teenage daughter who saw fit to
install Kazaa because some bright spark at her school had told her it
was the best way to get free music. As I understand it now, it's the
best way to get any number of things, most of them being things you
really wouldn't want to catch...

So, the PC (Win ME, firewalled by Zone Alarm, protected by McAffee VS -
unfortunately the latter was out of date) could have already been
infected by the time I took the decision to upgrade. It most likely was.
However, I suspect I made matters worse...

After uninstalling Kazaa, grounding my daughter for life and booting the
PC on the Symantec Internet Security CD and letting it take the 34 hours
it needed to scan for a virus and find nothing, I then ran the Windows
XP upgrade.

I did this with my Broadband connection active, with Zone Alarm still
running, because the instructions suggested Windoze would want to
connect to the Web to download the latest patches as part of its upgrade
process.

In hindsight, an exceptionally dumb move.

I suspect that the upshot of this is that at some point through the
upgrade process my Broadband connection became "un-firewalled", as Zone
Alarm got mangled by XP and XP defaults to not having its own firewall
active when it first installs.

So ME is now apparently upgraded to XP. I realise that the upgrade has
mucked up Zone Alarm so uninstall it and switch on the XP firewall.
Probably too late by now...

Try to install Norton Internet Security. Seems to install fine, but
doesn't fire up on rebooting. I catch on to this failure eventually,
uninstall it, switch off the XP firewall (thinking this might be the
problem) and reinstall it (again, giving myself unfirewalled exposure to
the Web - Doh!). Of course, no joy.

Better still, I start to get the RPC Service sporadically failing and
restarting my computer... Oh, and giving me 60 seconds warning each
time, which I guess could be construed as polite, but personally I think
the bastard PC is just rubbing my nose in it...

Some short time later, this leads me (via the web and Microsoft pages)
to the conclusion that I've most likely been affected by W32.Blaster or
one of its variants. This is also the likely reason why Norton Internet
Security is failing to install.

I find out how to fix the failure mode of the RPC service so that it
just restarts itself rather than my whole PC, so my PC is now stable
enough to do something with it.

I download the Norton W32.Blaster fix and run it.

Then I remember I haven't switched the XP firewall back on, and in the
realisation that Norton isn't doing what it said it would do on the box,
I abort the FixBlaster.exe scan and then switch the firewall back on.

On aborting the FixBlaster scan it tells me that its found and deleted
one infected file, suggesting that I'm on the right track...

Firewall is back on and I restart the FixBlaster scan, now feeling very
optimistic that I'm back on the right track. I have to go out, so leave
my PC to get on with things.

The scan eventually finishes, but finds nothing else.

Switch the RPC service failure mode back to rebooting the PC on fail,
expecting all to be well once more, and try to reinstall Norton Internet
Security... The RPC service fails, machine gets rebooted. Windows again
gives me the customary 60 seconds of warning in which to contemplate my
many failures.

Oh, and Norton Internet Security failed to install. Same problem as
before. I'm subsequently led by the Symantec site into running MSCONFIG
to try and identify whatever is apparently conflicting with it. MSCONFIG
starts up and gives me a few seconds to speed-read what I can and then
inexplicably closes. A bit like Norton. Well, at least I've identified
the likely conflict.

Everything is pointing back at a virus infection.

Running the Symantec online scan identifies a couple of hundred files
infected with W32.NetSky - I download the fix from Symantec, run the
scan and let it do its thing. A couple of hundred files are deleted.
Things are looking up?

Nope. My old friend the RPC Service continues to reboot my PC with
malicious and mocking glee, MSCONFIG can't keep it up and Norton
Internet Security keeps flopping. Oh, and the Windows Update doesn't,
well, update. It says it does, it downloads and executes the update, but
on re-running the scan the Microsoft site tells me I still need the
various critical updates I thought I'd just installed. It also leaves
lots of folders in my C:\ with long gibberish names. I imagine those are
the installation files for the various patches and Hotfixes Microsoft
update tried and failed to load.

Rerunning the Symantec FixBlaster scan previously downloaded finds
nothing. As of last night, re-running the Symantec Online scan finds
nothing. But the machine is behaving as if it were still infected with
W32.Blaster. I finally went to bed last night in frustration at about
3am only to be kept awake by nightmares involving worms, wooden horses
and an emasculating inability to bolt the stable door irrespective of
the presence of the bloody horse or otherwise.

I haven't downloaded a fresh copy of the FixBlaster.exe scan from
Symantec since I first downloaded and ran it on Saturday. Is it possible
I've re-infected myself with an updated version of the virus since then?
Or the virus has chewed up the FixBlaster.exe? Or I've infected myself
with something else entirely that has the same symptoms? But wouldn't
the Symantec Online scan have caught something other than NetSky if that
had been the case?

Tonight I plan to start again. I've cancelled the various things I'd
normally be committed to on a Monday night. Last night's frustration and
despair has turned into a quiet anger and simmering hatred of whatever
nasty little bug has infected my PC. It's like having somebody sleep
with your wife...

So I plan to download a fresh copy of the Blaster fix and start from
there, possibly from somebody other than Symantec. And keep my XP
firewall active whilst I trawl the web for other ideas, even though that
feels a bit like closing the stable door after the horse has bolted.

If it comes to it, I'll reformat and reinstall everything from scratch.
But I really, really hope to avoid that if I can. Some time back (like
about two years) I took the decision that backups were unnecessary, as
it was only my personal PC, so if I ended up having to reinstall from
scratch I wouldn't loose anything critical.

I was only partly wrong. The data is only one of my worries. Having to
reconfigure all my applications from scratch, find drivers for all my
odd bits and pieces like firewire cards and network cards and so on, to
tweak everything so that it's running just as I like... Even the games I
play, flight simulators (IL2 rules) and Half-life CTF / Day of Defeat
for the most part, just reinstalling them and getting everything patched
just so... Doesn't bear thinking about.

Anyway. I apologise for sucking up everybody's bandwidth and patience
with the sort of tirade to which the obvious response is "cry more
n00b". But I actually feel a little better now, and ready to start again
afresh tonight.


-Bill

 

[Will Denny]

Hi Bill

Problems or what? Well done for grounding your daughter - if you can make it stick for that long - I never could ). May I suggest that you uninstall - if possible - any and all Norton products for the time being. See if that helps. For the recurring RPC problems:

www.kellys-korner-xp.com/xp_qr.htm#rpc

Courtesy of MVP Kelly Theriot.

"Virus Alert About the Blaster Worm and Its Variants"
http://support.microsoft.com/?id=826955

"What You Should Know About the Blaster Worm and Its Variants"
http://www.microsoft.com/security/incident/blast.asp

Any problems, please post back. I thought that Demon was defunct - obviously not.

--

Will Denny
MS-MVP Windows - Shell/User


| Quite a long, complicated story as much to blow off steam as anything
| else, though any help, sympathy or advice would be much appreciated.
| Judging from related threads that I've read here I'm not the first to
| fall foul of this particular problem...
|
| If nothing else, this is an anecdote of why it's so necessary to keep
| your OS patched up, a decent anti-virus package installed, actively
| scanning and totally up to date, and your Internet connection completely
| firewalled.
|
| Began sometime last week with the decision to upgrade my existing copy
| of Windows ME to XP Home Edition and install Symantec Internet Security
| 2004.
|
| The catalyst for this decision was my teenage daughter who saw fit to
| install Kazaa because some bright spark at her school had told her it
| was the best way to get free music. As I understand it now, it's the
| best way to get any number of things, most of them being things you
| really wouldn't want to catch...
|
| So, the PC (Win ME, firewalled by Zone Alarm, protected by McAffee VS -
| unfortunately the latter was out of date) could have already been
| infected by the time I took the decision to upgrade. It most likely was.
| However, I suspect I made matters worse...
|
| After uninstalling Kazaa, grounding my daughter for life and booting the
| PC on the Symantec Internet Security CD and letting it take the 34 hours
| it needed to scan for a virus and find nothing, I then ran the Windows
| XP upgrade.
|
| I did this with my Broadband connection active, with Zone Alarm still
| running, because the instructions suggested Windoze would want to
| connect to the Web to download the latest patches as part of its upgrade
| process.
|
| In hindsight, an exceptionally dumb move.
|
| I suspect that the upshot of this is that at some point through the
| upgrade process my Broadband connection became "un-firewalled", as Zone
| Alarm got mangled by XP and XP defaults to not having its own firewall
| active when it first installs.
|
| So ME is now apparently upgraded to XP. I realise that the upgrade has
| mucked up Zone Alarm so uninstall it and switch on the XP firewall.
| Probably too late by now...
|
| Try to install Norton Internet Security. Seems to install fine, but
| doesn't fire up on rebooting. I catch on to this failure eventually,
| uninstall it, switch off the XP firewall (thinking this might be the
| problem) and reinstall it (again, giving myself unfirewalled exposure to
| the Web - Doh!). Of course, no joy.
|
| Better still, I start to get the RPC Service sporadically failing and
| restarting my computer... Oh, and giving me 60 seconds warning each
| time, which I guess could be construed as polite, but personally I think
| the bastard PC is just rubbing my nose in it...
|
| Some short time later, this leads me (via the web and Microsoft pages)
| to the conclusion that I've most likely been affected by W32.Blaster or
| one of its variants. This is also the likely reason why Norton Internet
| Security is failing to install.
|
| I find out how to fix the failure mode of the RPC service so that it
| just restarts itself rather than my whole PC, so my PC is now stable
| enough to do something with it.
|
| I download the Norton W32.Blaster fix and run it.
|
| Then I remember I haven't switched the XP firewall back on, and in the
| realisation that Norton isn't doing what it said it would do on the box,
| I abort the FixBlaster.exe scan and then switch the firewall back on.
|
| On aborting the FixBlaster scan it tells me that its found and deleted
| one infected file, suggesting that I'm on the right track...
|
| Firewall is back on and I restart the FixBlaster scan, now feeling very
| optimistic that I'm back on the right track. I have to go out, so leave
| my PC to get on with things.
|
| The scan eventually finishes, but finds nothing else.
|
| Switch the RPC service failure mode back to rebooting the PC on fail,
| expecting all to be well once more, and try to reinstall Norton Internet
| Security... The RPC service fails, machine gets rebooted. Windows again
| gives me the customary 60 seconds of warning in which to contemplate my
| many failures.
|
| Oh, and Norton Internet Security failed to install. Same problem as
| before. I'm subsequently led by the Symantec site into running MSCONFIG
| to try and identify whatever is apparently conflicting with it. MSCONFIG
| starts up and gives me a few seconds to speed-read what I can and then
| inexplicably closes. A bit like Norton. Well, at least I've identified
| the likely conflict.
|
| Everything is pointing back at a virus infection.
|
| Running the Symantec online scan identifies a couple of hundred files
| infected with W32.NetSky - I download the fix from Symantec, run the
| scan and let it do its thing. A couple of hundred files are deleted.
| Things are looking up?
|
| Nope. My old friend the RPC Service continues to reboot my PC with
| malicious and mocking glee, MSCONFIG can't keep it up and Norton
| Internet Security keeps flopping. Oh, and the Windows Update doesn't,
| well, update. It says it does, it downloads and executes the update, but
| on re-running the scan the Microsoft site tells me I still need the
| various critical updates I thought I'd just installed. It also leaves
| lots of folders in my C:\ with long gibberish names. I imagine those are
| the installation files for the various patches and Hotfixes Microsoft
| update tried and failed to load.
|
| Rerunning the Symantec FixBlaster scan previously downloaded finds
| nothing. As of last night, re-running the Symantec Online scan finds
| nothing. But the machine is behaving as if it were still infected with
| W32.Blaster. I finally went to bed last night in frustration at about
| 3am only to be kept awake by nightmares involving worms, wooden horses
| and an emasculating inability to bolt the stable door irrespective of
| the presence of the bloody horse or otherwise.
|
| I haven't downloaded a fresh copy of the FixBlaster.exe scan from
| Symantec since I first downloaded and ran it on Saturday. Is it possible
| I've re-infected myself with an updated version of the virus since then?
| Or the virus has chewed up the FixBlaster.exe? Or I've infected myself
| with something else entirely that has the same symptoms? But wouldn't
| the Symantec Online scan have caught something other than NetSky if that
| had been the case?
|
| Tonight I plan to start again. I've cancelled the various things I'd
| normally be committed to on a Monday night. Last night's frustration and
| despair has turned into a quiet anger and simmering hatred of whatever
| nasty little bug has infected my PC. It's like having somebody sleep
| with your wife...
|
| So I plan to download a fresh copy of the Blaster fix and start from
| there, possibly from somebody other than Symantec. And keep my XP
| firewall active whilst I trawl the web for other ideas, even though that
| feels a bit like closing the stable door after the horse has bolted.
|
| If it comes to it, I'll reformat and reinstall everything from scratch.
| But I really, really hope to avoid that if I can. Some time back (like
| about two years) I took the decision that backups were unnecessary, as
| it was only my personal PC, so if I ended up having to reinstall from
| scratch I wouldn't loose anything critical.
|
| I was only partly wrong. The data is only one of my worries. Having to
| reconfigure all my applications from scratch, find drivers for all my
| odd bits and pieces like firewire cards and network cards and so on, to
| tweak everything so that it's running just as I like... Even the games I
| play, flight simulators (IL2 rules) and Half-life CTF / Day of Defeat
| for the most part, just reinstalling them and getting everything patched
| just so... Doesn't bear thinking about.
|
| Anyway. I apologise for sucking up everybody's bandwidth and patience
| with the sort of tirade to which the obvious response is "cry more
| n00b". But I actually feel a little better now, and ready to start again
| afresh tonight.
|
|
| -Bill

 

[AnnonUser]

Quite a long, complicated story as much to blow off steam as anything
else, though any help, sympathy or advice would be much appreciated.
Judging from related threads that I've read here I'm not the first to
fall foul of this particular problem...

If nothing else, this is an anecdote of why it's so necessary to keep
your OS patched up, a decent anti-virus package installed, actively
scanning and totally up to date, and your Internet connection
completely firewalled.

Began sometime last week with the decision to upgrade my existing copy
of Windows ME to XP Home Edition and install Symantec Internet
Security 2004.

The catalyst for this decision was my teenage daughter who saw fit to
install Kazaa because some bright spark at her school had told her it
was the best way to get free music. As I understand it now, it's the
best way to get any number of things, most of them being things you
really wouldn't want to catch...

So, the PC (Win ME, firewalled by Zone Alarm, protected by McAffee VS
- unfortunately the latter was out of date) could have already been
infected by the time I took the decision to upgrade. It most likely
was. However, I suspect I made matters worse...

After uninstalling Kazaa, grounding my daughter for life and booting
the PC on the Symantec Internet Security CD and letting it take the 34
hours it needed to scan for a virus and find nothing, I then ran the
Windows XP upgrade.

I did this with my Broadband connection active, with Zone Alarm still
running, because the instructions suggested Windoze would want to
connect to the Web to download the latest patches as part of its
upgrade process.

In hindsight, an exceptionally dumb move.

I suspect that the upshot of this is that at some point through the
upgrade process my Broadband connection became "un-firewalled", as
Zone Alarm got mangled by XP and XP defaults to not having its own
firewall active when it first installs.

So ME is now apparently upgraded to XP. I realise that the upgrade has
mucked up Zone Alarm so uninstall it and switch on the XP firewall.
Probably too late by now...

Try to install Norton Internet Security. Seems to install fine, but
doesn't fire up on rebooting. I catch on to this failure eventually,
uninstall it, switch off the XP firewall (thinking this might be the
problem) and reinstall it (again, giving myself unfirewalled exposure
to the Web - Doh!). Of course, no joy.

Better still, I start to get the RPC Service sporadically failing and
restarting my computer... Oh, and giving me 60 seconds warning each
time, which I guess could be construed as polite, but personally I
think the bastard PC is just rubbing my nose in it...

Some short time later, this leads me (via the web and Microsoft pages)
to the conclusion that I've most likely been affected by W32.Blaster
or one of its variants. This is also the likely reason why Norton
Internet Security is failing to install.

I find out how to fix the failure mode of the RPC service so that it
just restarts itself rather than my whole PC, so my PC is now stable
enough to do something with it.

I download the Norton W32.Blaster fix and run it.

Then I remember I haven't switched the XP firewall back on, and in the
realisation that Norton isn't doing what it said it would do on the
box, I abort the FixBlaster.exe scan and then switch the firewall back
on.

On aborting the FixBlaster scan it tells me that its found and deleted
one infected file, suggesting that I'm on the right track...

Firewall is back on and I restart the FixBlaster scan, now feeling
very optimistic that I'm back on the right track. I have to go out, so
leave my PC to get on with things.

The scan eventually finishes, but finds nothing else.

Switch the RPC service failure mode back to rebooting the PC on fail,
expecting all to be well once more, and try to reinstall Norton
Internet Security... The RPC service fails, machine gets rebooted.
Windows again gives me the customary 60 seconds of warning in which to
contemplate my many failures.

Oh, and Norton Internet Security failed to install. Same problem as
before. I'm subsequently led by the Symantec site into running
MSCONFIG to try and identify whatever is apparently conflicting with
it. MSCONFIG starts up and gives me a few seconds to speed-read what I
can and then inexplicably closes. A bit like Norton. Well, at least
I've identified the likely conflict.

Everything is pointing back at a virus infection.

Running the Symantec online scan identifies a couple of hundred files
infected with W32.NetSky - I download the fix from Symantec, run the
scan and let it do its thing. A couple of hundred files are deleted.
Things are looking up?

Nope. My old friend the RPC Service continues to reboot my PC with
malicious and mocking glee, MSCONFIG can't keep it up and Norton
Internet Security keeps flopping. Oh, and the Windows Update doesn't,
well, update. It says it does, it downloads and executes the update,
but on re-running the scan the Microsoft site tells me I still need
the various critical updates I thought I'd just installed. It also
leaves lots of folders in my C:\ with long gibberish names. I imagine
those are the installation files for the various patches and Hotfixes
Microsoft update tried and failed to load.

Rerunning the Symantec FixBlaster scan previously downloaded finds
nothing. As of last night, re-running the Symantec Online scan finds
nothing. But the machine is behaving as if it were still infected with
W32.Blaster. I finally went to bed last night in frustration at about
3am only to be kept awake by nightmares involving worms, wooden horses
and an emasculating inability to bolt the stable door irrespective of
the presence of the bloody horse or otherwise.

I haven't downloaded a fresh copy of the FixBlaster.exe scan from
Symantec since I first downloaded and ran it on Saturday. Is it
possible I've re-infected myself with an updated version of the virus
since then? Or the virus has chewed up the FixBlaster.exe? Or I've
infected myself with something else entirely that has the same
symptoms? But wouldn't the Symantec Online scan have caught something
other than NetSky if that had been the case?

Tonight I plan to start again. I've cancelled the various things I'd
normally be committed to on a Monday night. Last night's frustration
and despair has turned into a quiet anger and simmering hatred of
whatever nasty little bug has infected my PC. It's like having
somebody sleep with your wife...

So I plan to download a fresh copy of the Blaster fix and start from
there, possibly from somebody other than Symantec. And keep my XP
firewall active whilst I trawl the web for other ideas, even though
that feels a bit like closing the stable door after the horse has bolted.

If it comes to it, I'll reformat and reinstall everything from
scratch. But I really, really hope to avoid that if I can. Some time
back (like about two years) I took the decision that backups were
unnecessary, as it was only my personal PC, so if I ended up having to
reinstall from scratch I wouldn't loose anything critical.

I was only partly wrong. The data is only one of my worries. Having to
reconfigure all my applications from scratch, find drivers for all my
odd bits and pieces like firewire cards and network cards and so on,
to tweak everything so that it's running just as I like... Even the
games I play, flight simulators (IL2 rules) and Half-life CTF / Day of
Defeat for the most part, just reinstalling them and getting
everything patched just so... Doesn't bear thinking about.

Anyway. I apologise for sucking up everybody's bandwidth and patience
with the sort of tirade to which the obvious response is "cry more
n00b". But I actually feel a little better now, and ready to start
again afresh tonight.


-Bill

Your story is an easy and fascinating read because you wrote in
sentences and paragraphs. The nightmare posts are run-on sentences in
caps.
You might want to try TrendMicro and McAfee Stinger for online scans.
Do you know how to stop the shutdown? You never said. Start - Run -
type cmd
in the command line type shutdown -a
You might also want to consider installing other protection -- you never
said if you have them, so . . .
Ad-Aware 6.0 - for removing spyware
http://www.lavasoftusa.com/

Spybot Search & Destroy - for removing spyware
http://www.safer-networking.org/

AdAware and Spybot complement one another -- update and run both.

CWShredder - gets rid of page hijackers
http://www.majorgeeks.com/download4086.html

Google Toolbar - for blocking popups

http://toolbar.google.com/

Before running the Spybot and Ad-Aware, delete temporary internet files
and internet history.

The anti malware stuff should be especially important since you've had
the virus KaZaa.

Good luck. Post back. There are some fine experts on this group, and I
imagine you'll be getting more responses than just mine. If you need
additional help with this mess, may I suggest Annoyances.org.

 

[Wislu Plethora]

-----Original Message-----
Quite a long, complicated story as much to blow off steam as anything
else, though any help, sympathy or advice would be much appreciated.
Judging from related threads that I've read here I'm not the first to
fall foul of this particular problem...

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

 

[dglock]

good luck, bill!
it seems you have already spent as much time as it would
take to start from scratch!
that may be the only way to get out of you problems.
don

 

[Joh N.]

Wislu Plethora, after spending 3 minutes figuring out which end of the pen to

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

Wow, a genius in the sack of hammers, speaks up.

 

[Bill Gribble]

it seems you have already spent as much time as it would take to start
from scratch! that may be the only way to get out of you problems. don

I think it was as much the principle of the thing as anything else. By
the way, we won. I now have a freshly patched, protected, malware and
virus free installation of XP, and I managed to keep my hard-drive
intact. If that's all you need to know (or already too much information)
then stop reading now. Please don't let me send you off to sleep ;-)

Hero of the hour is probably goes to SpyBot S&D, closely followed by
Kelly's Korner. Muppet of the Moment award has to go to Symantec (okay,
I guess I have first claim on it for getting infected in the first
place, but once infected their site and their software was little to no
help at all).

First thing I did on getting home last night was switch on the standard
XP Firewall, though I left myself unplugged from the wall to be sure
that whatever I was already infected with had as little a chance of
possible of making matters worse.

At this point it became very apparent that something was wrong. The
machine was very sluggish, and Taskmanager showed the CPU usage as
continuously levelled out at 100%. I went down the various services,
terminating everything that wasn't obvious to me as essential and
Windows in origin, keeping an eye on the CPU usage level. Most of the
services went without a whisper of complaint. Something called ASCV
didn't, however. It terminated, the CPU usage dropped as low as 90% and
then it respawned itself and the usage levelled back out at 100%. After
getting as far down as this, the system went unstable and I had to
reboot.

I uninstalled every non essential application I could find, as much to
speed up the scanning time as anything else. In the end I reduced the
amount of junk on my hard disk from about 37gb to around 17gb. Along the
way this involved uninstalling the nerfed version of Norton's Internet
Security. The moment I got rid of Norton, the CPU usage stopped
thrashing and the machine response times returned to normal. Thank-you,
Mr Denny, for suggesting this. Should have done it first thing, but I
got there in the end!

Of course, still had a virus. So I plugged the Internet back in. I
should mention that, at this point, the RPC service recovery was still
set to restart (as opposed to reboot) and System Restore was still
switched off from the weekend's previous attempts to fix this problem.

The network traffic levels on the Taskmanager network tab tickle along
at 0% on the broadband connection. Not sure if an RPC worm would make
enough noise to show at this level, but the apparent quiet was
comforting.

Download and run McAfee's Stinger. It identifies and deletes a single
instance of the Netsky virus in my windows\system32 folder, but nothing
else. I update my existing installation of Adaware and run it. It
identifies an absolute load, from tracking cookies to Malware files to
Hacker exploits and hijacking attempts in my Registry to whole folders
of suspicious junk. I let it clear out everything it wants.

I then install, update and run Spybot S&D. It finds a pile more, clears
the stuff out and then identifies a Dialler and a dll that it can't wipe
and asks for a reboot. I let it reboot, and it sorts out the stragglers.

So it finally feels like I'm getting somewhere, slowly...

I download and re-run the FixBlaster.exe from Symantec. It completes,
finding nothing, and indicates that Windoze is patched up and unexposed.
Not quite sure how I managed that, but conclude that something I did on
Sunday must have worked to achieve this, so not an entirely wasted
weekend. Of course, always the chance that a later virus cleared out
Blaster and patched my RPC vulnerability for me.

I reset the recovery action of the RPC service back to "Mock and Reboot"
mode. Everything stays stable, so it really does look like we've cleared
out Blaster & friends.

I try and run Msconfig, because I know this was one of the other
symptoms I found. It closes without explanation after a few moments,
just as before. Regedit does the same thing. Not quite home and dry yet,
then.

I visit Kelly's Korner and download the Msconfig, Regedit and Taskmon
emergency replacements on offer there. The "emergency" version of
Msconfig (Msconfig1) stays up, as does Regedit.

Between Msconfig1 and the services tab of Taskmonitor I trawl down
through the various services running. In Msconfig1 I spot a startup
service called "Windows cfg" which, now I think of it, sounds somewhat
dodgy. Checking its properties shows that the actual executable is a
file called "ascv.exe", which, of course, leads directly back to that
respawning ASCV service that I found earlier.

Can't find anything on Google to legibly explain what ASCV or "Windows
cfg" is so I disable it in Msconfig1 and reboot.

System boots back up sweet as a nut, apparently none the worse for the
lack of our friend ascv.exe ... I locate two files, ascv.exe and
ascv.exe.poly in my windows\system32 folder and move them somewhere out
of harm's way. Don't want to delete them until I know what they are, and
so far none of the anti-virus or malware scanners have found anything
wrong with them.

I try the original version of Msconfig. It opens up and stays open,
happy as Larry. I open up the original Regedit. Ditto. I export my
entire registry just in case what I do next screws up my apparent run of
good luck, then trawl through looking for anything connected to ascv.
Lots of registry keys get deleted.

Reboot, all remains well. The "Microsoft cfg" service no longer shows as
one of the potential Msconfig startup services. He isn't missed

Everything now seems clean, so I take the leap and put the Norton
Internet Security CD back in the drive ...

<RANT>I nominate Symantic for my Muppet of the Moment award on two
counts and one caveat. The caveat is that I can't award it to myself
(even though I deserve it more), that would be favouritism. As for the
two counts....

First, the inevitable layman's path to an anti-virus / Internet security
product is infection and compromise. But once infected and compromised,
far from being an asset to my attempts to claw my machine back to
safety, the Norton Internet Security product, and, MORE TO THE POINT,
the Symantec website have been not only NO HELP AT ALL, but worse, an
ACTUAL LIABILITY.

Some of the most pertinent advice in this battle was Will Denny's advice
to put Norton to one side and leave it until I was clean. Even if you
argue that Norton has the odds stacked against it and will inevitably be
ambushed if the virus gets on the machine first, I'd argue that
Symantec, at the very least, could at least tell you this in BIG BOLD
LETTERS on their website.

And second, and IMHO, most damning, is the installation advice their
manual gives for Norton Internet Security. They point out that if you
are running XP then you probably have the XP firewall running. They then
instruct you to switch it off, saying that it will interfere with the
installation.

Now, simple logic dictates that if you have XP firewall running then you
have an existing and probably active Internet connection. Switching off
your firewall protection for even a minute or two without first
UNPLUGGING the Internet from your machine is tantamount to digital
suicide in this day and age when running XP.

Now, I will accept the argument that I should have known better. I
really should have. But this product is aimed at the home user as much
as anybody, so I'd argue that a significant majority wouldn't know any
better than to follow the instructions given by the apparent
experts.</RANT>

Not that I'm for a moment pretending that I haven't been the author of
my own misfortune here. But I just needed to get that out. Anyway,
moving swiftly on ...

I unplug the Internet, switch off the XP firewall and take the plunge.
Norton Internet Security installs as nicely as you like. On reboot I
walk through the Norton wizard that now pops up, and once I'm happy
Norton thinks it's protecting me, reconnect the Internet.

From here on in I have to say Symantec / Norton Internet Security redeem
themselves admirably. The anti-virus component goes off and updates its
definitions and we then run a full scan. It *now* identifies our old
friends ascv.exe and ascv.exe.poly as W32.HLLW.Gaobot.gen and further
goes on to identify W32.Randex.gen as still present and previously
undetected elsewhere. It deals with the now identified threats with a
minimum of fuss.

I then log onto http://grc.com - the site provides an online security
scan called "ShieldsUp" that is very comprehensive, clear in what its
doing and what it does and that I can't recommend enough. Their probing
and testing gives my Internet connection (and thus the newly set up
Norton Firewall) an absolutely clean bill of health and credit it with
total stealth.

Finally, I run the Windows Update and patch my machine up with all the
outstanding critical patches. This time, in contrast to every previous
attempt, we meet with absolute success. I switch System Restore back on
and take a Restore Point. Not sure why, as I suspect I'll never use it,
but I do it just for the sake of things and because I can.

Now that it's installed and running, Norton Internet Security is doing a
fine job and is, IMHO, a lovely piece of kit. We'll see how well it (and
my daughter's fear of being grounded again and having her soon to be
restored computer privileges revoked forever) protects us in the weeks
to come.

But for now, we're finally home and dry. I even got a half decent
night's sleep. Just wanted to say thank-you to those of you here that
have offered your advice, sympathy and support. With any luck I won't
have woken Wislu Plethora


-Bill

 

[AnnonUser]

I think it was as much the principle of the thing as anything else. By
the way, we won. I now have a freshly patched, protected, malware and
virus free installation of XP, and I managed to keep my hard-drive
intact. If that's all you need to know (or already too much
information) then stop reading now. Please don't let me send you off
to sleep ;-)

Hero of the hour is probably goes to SpyBot S&D, closely followed by
Kelly's Korner. Muppet of the Moment award has to go to Symantec
(okay, I guess I have first claim on it for getting infected in the
first place, but once infected their site and their software was
little to no help at all).

First thing I did on getting home last night was switch on the
standard XP Firewall, though I left myself unplugged from the wall to
be sure that whatever I was already infected with had as little a
chance of possible of making matters worse.

At this point it became very apparent that something was wrong. The
machine was very sluggish, and Taskmanager showed the CPU usage as
continuously levelled out at 100%. I went down the various services,
terminating everything that wasn't obvious to me as essential and
Windows in origin, keeping an eye on the CPU usage level. Most of the
services went without a whisper of complaint. Something called ASCV
didn't, however. It terminated, the CPU usage dropped as low as 90%
and then it respawned itself and the usage levelled back out at 100%.
After getting as far down as this, the system went unstable and I had
to reboot.

I uninstalled every non essential application I could find, as much to
speed up the scanning time as anything else. In the end I reduced the
amount of junk on my hard disk from about 37gb to around 17gb. Along
the way this involved uninstalling the nerfed version of Norton's
Internet Security. The moment I got rid of Norton, the CPU usage
stopped thrashing and the machine response times returned to normal.
Thank-you, Mr Denny, for suggesting this. Should have done it first
thing, but I got there in the end!

Of course, still had a virus. So I plugged the Internet back in. I
should mention that, at this point, the RPC service recovery was still
set to restart (as opposed to reboot) and System Restore was still
switched off from the weekend's previous attempts to fix this problem.

The network traffic levels on the Taskmanager network tab tickle along
at 0% on the broadband connection. Not sure if an RPC worm would make
enough noise to show at this level, but the apparent quiet was
comforting.

Download and run McAfee's Stinger. It identifies and deletes a single
instance of the Netsky virus in my windows\system32 folder, but
nothing else. I update my existing installation of Adaware and run it.
It identifies an absolute load, from tracking cookies to Malware files
to Hacker exploits and hijacking attempts in my Registry to whole
folders of suspicious junk. I let it clear out everything it wants.

I then install, update and run Spybot S&D. It finds a pile more,
clears the stuff out and then identifies a Dialler and a dll that it
can't wipe and asks for a reboot. I let it reboot, and it sorts out
the stragglers.

So it finally feels like I'm getting somewhere, slowly...

I download and re-run the FixBlaster.exe from Symantec. It completes,
finding nothing, and indicates that Windoze is patched up and
unexposed. Not quite sure how I managed that, but conclude that
something I did on Sunday must have worked to achieve this, so not an
entirely wasted weekend. Of course, always the chance that a later
virus cleared out Blaster and patched my RPC vulnerability for me.

I reset the recovery action of the RPC service back to "Mock and
Reboot" mode. Everything stays stable, so it really does look like
we've cleared out Blaster & friends.

I try and run Msconfig, because I know this was one of the other
symptoms I found. It closes without explanation after a few moments,
just as before. Regedit does the same thing. Not quite home and dry
yet, then.

I visit Kelly's Korner and download the Msconfig, Regedit and Taskmon
emergency replacements on offer there. The "emergency" version of
Msconfig (Msconfig1) stays up, as does Regedit.

Between Msconfig1 and the services tab of Taskmonitor I trawl down
through the various services running. In Msconfig1 I spot a startup
service called "Windows cfg" which, now I think of it, sounds somewhat
dodgy. Checking its properties shows that the actual executable is a
file called "ascv.exe", which, of course, leads directly back to that
respawning ASCV service that I found earlier.

Can't find anything on Google to legibly explain what ASCV or "Windows
cfg" is so I disable it in Msconfig1 and reboot.

System boots back up sweet as a nut, apparently none the worse for the
lack of our friend ascv.exe ... I locate two files, ascv.exe and
ascv.exe.poly in my windows\system32 folder and move them somewhere
out of harm's way. Don't want to delete them until I know what they
are, and so far none of the anti-virus or malware scanners have found
anything wrong with them.

I try the original version of Msconfig. It opens up and stays open,
happy as Larry. I open up the original Regedit. Ditto. I export my
entire registry just in case what I do next screws up my apparent run
of good luck, then trawl through looking for anything connected to
ascv. Lots of registry keys get deleted.

Reboot, all remains well. The "Microsoft cfg" service no longer shows
as one of the potential Msconfig startup services. He isn't missed

Everything now seems clean, so I take the leap and put the Norton
Internet Security CD back in the drive ...

<RANT>I nominate Symantic for my Muppet of the Moment award on two
counts and one caveat. The caveat is that I can't award it to myself
(even though I deserve it more), that would be favouritism. As for the
two counts....

First, the inevitable layman's path to an anti-virus / Internet
security product is infection and compromise. But once infected and
compromised, far from being an asset to my attempts to claw my machine
back to safety, the Norton Internet Security product, and, MORE TO THE
POINT, the Symantec website have been not only NO HELP AT ALL, but
worse, an ACTUAL LIABILITY.

Some of the most pertinent advice in this battle was Will Denny's
advice to put Norton to one side and leave it until I was clean. Even
if you argue that Norton has the odds stacked against it and will
inevitably be ambushed if the virus gets on the machine first, I'd
argue that Symantec, at the very least, could at least tell you this
in BIG BOLD LETTERS on their website.

And second, and IMHO, most damning, is the installation advice their
manual gives for Norton Internet Security. They point out that if you
are running XP then you probably have the XP firewall running. They
then instruct you to switch it off, saying that it will interfere with
the installation.

Now, simple logic dictates that if you have XP firewall running then
you have an existing and probably active Internet connection.
Switching off your firewall protection for even a minute or two
without first UNPLUGGING the Internet from your machine is tantamount
to digital suicide in this day and age when running XP.

Now, I will accept the argument that I should have known better. I
really should have. But this product is aimed at the home user as much
as anybody, so I'd argue that a significant majority wouldn't know any
better than to follow the instructions given by the apparent
experts.</RANT>

Not that I'm for a moment pretending that I haven't been the author of
my own misfortune here. But I just needed to get that out. Anyway,
moving swiftly on ...

I unplug the Internet, switch off the XP firewall and take the plunge.
Norton Internet Security installs as nicely as you like. On reboot I
walk through the Norton wizard that now pops up, and once I'm happy
Norton thinks it's protecting me, reconnect the Internet.

From here on in I have to say Symantec / Norton Internet Security
redeem themselves admirably. The anti-virus component goes off and
updates its definitions and we then run a full scan. It *now*
identifies our old friends ascv.exe and ascv.exe.poly as
W32.HLLW.Gaobot.gen and further goes on to identify W32.Randex.gen as
still present and previously undetected elsewhere. It deals with the
now identified threats with a minimum of fuss.

I then log onto http://grc.com - the site provides an online security
scan called "ShieldsUp" that is very comprehensive, clear in what its
doing and what it does and that I can't recommend enough. Their
probing and testing gives my Internet connection (and thus the newly
set up Norton Firewall) an absolutely clean bill of health and credit
it with total stealth.

Finally, I run the Windows Update and patch my machine up with all the
outstanding critical patches. This time, in contrast to every previous
attempt, we meet with absolute success. I switch System Restore back
on and take a Restore Point. Not sure why, as I suspect I'll never use
it, but I do it just for the sake of things and because I can.

Now that it's installed and running, Norton Internet Security is doing
a fine job and is, IMHO, a lovely piece of kit. We'll see how well it
(and my daughter's fear of being grounded again and having her soon to
be restored computer privileges revoked forever) protects us in the
weeks to come.

But for now, we're finally home and dry. I even got a half decent
night's sleep. Just wanted to say thank-you to those of you here that
have offered your advice, sympathy and support. With any luck I won't
have woken Wislu Plethora


-Bill

Thanks for posting back.
Glad to hear you finally got things straightened out -- but what an
ordeal!
I know you paid good money for the Norton Suite, but when renewal time
comes around, allow me to suggest F-Prot Antivirus from Frisk
International. It's not a resource hog, has an easy interface, and best
of all, it offers actual tech support -- as in they answer e-mails.
I've used it for years and absolutely swear by it. I run it with
ZoneAlarm, which I also wouldn't be without.
Go have a read about F-Prot. http://www.f-prot.com/
Also, you might want to have this site in your back pocket for
emergencies. His Windows XP Service Configurations sections has a
comprehensive listing of XP services below the table of service names.
http://www.blackviper.com/index.html

 

[David]

Just wanted to say thanks for this thread. I was having loads of
troubles with msconfig and regedit bombing out for no reason.

My problems sorted!

Ta.

 

[hermes]

Before the MVP (M$ Victim Poster) Hermes responded, David typed:

Just wanted to say thanks for this thread. I was having loads of
troubles with msconfig and regedit bombing out for no reason.

My problems sorted!

Ta.

Thread?!? What thread?!? This is the only post in this "thread" I can
find.

--
hermes
DRM sux! Treacherous Computing kills our virtual civil liberties!
http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

Windows XP crashed.
I am the Blue Screen of Death.
No one hears your screams.

Yesterday it worked.
Today it is not working.
Windows is like that.