worm? remote procedure call

[TLF]

I earlier posted the note at the bottom, and got the
reply below. Unfortunately, I cannot find the msblast.exe
in task manager, processes, and I have also tried running
the removal tool form symantec and it says I do not have
th eworm.

please help.

Subject: Re: worm? - remote procedure access shutdown
From: "purplehaz" <[email protected]> Sent: 12/1/2003
10:25:18 AM




You are infected with the Blaster worm virus.



To stop the rebooting/shutdowns, right click on the task
bar, choose task
manager, processes tab, look for msblast.exe. Highlight
it and click end
process. Then turn on the xp firewall.

To turn on the firewall: control panel, network and
internet connections,
network connections, right click your connection,
properties, advanced tab,
check the protect my computer box. Do this as quickly as
you can once the
desktop comes up. Then visit the sites below for the
removal and patch info.

Symantec: removal info and removal tool
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html

Also make sure to follow the links to the Microsoft pages
for the patch or
visit windows update for the patch after you remove it.

http://support.microsoft.com/?kbid=823980

http://www.microsoft.com/security/incident/blast.asp





message

I loaded Windows XP on my desktop a week or so ago. I am
connected to the internet through SBC dsl. Two days ago, I
bought a router and a laptop (the laptop has centrino and
is a wireless connection to the same dsl line).

Since setting up the router and laptop two days ago, I
occasionally get a message on the desktop saying that the
remote access (or something like that) has stopped and
that the computer will shut down in 60 seconds. Then it
counts down, shuts down, and restarts.

I heard this may be like the blaster worm, but do not know
much about it. I have already downloaded and installed the
critical updates for XP, but still face the same problem.

Thanks

..

 

[guestuser]

The symptoms are identical to those caused by the blaster.exe worm. You may
have a variant of some kind. Take a close look at the processes running and
make sure you don't have something on there you can't readily identify. Use
another scanner to check your system for worms and viruses.

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

For a quick, small removal tool for W32.Blaster.Worm, see
www.kellys-korner-xp.com/xp_qr.htm#rpc

http://www.microsoft.com/security/incident/blast.asp

826955 Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?id=826955

 

[Guest]

go to the admin console, on RPC rt click > properties on
the recovery tab, set first failure "Take no action" or re-
start svc. Worked for me.

 

[TLF]

I found another fix at Trend Micro Inc. It actually found
a "virus" (I'm assuming it meant a worm since the tool
was specifically for the blaster worm), then deleted it.
I ran the tool again, and it found nothing. Thanks for
the help.