Announcement

**Pekka** · August 11, 2003, 16:33

Yes, but even after formatting you should definitely check out and find out what virus you might be having, because all viruses do not go away with formatting. If it is a virus.

**mrmitchell** · August 11, 2003, 16:34

True, Pekka. Run virus scan too. Of course, however, something you should've already done.

**faded glory** · August 11, 2003, 16:57

i got it to reinstalled win2k to fix. Its an svchost.exe error. Hit alt-cntrl-del and look at. Theres in article in MKB that discusses the issue.

**reismark** · August 11, 2003, 17:31

I posted some information I found about an RPC buffer overrun vulnerability from Symantec over at CGN. That appears to be the problem (the error message one of my CGNers got reported an unexpected termination of the RPC service, which would definitely be caused by a buffer overrun).

A Microsoft patch will probably solve the problem.

**The Andy-Man** · August 11, 2003, 17:44

Can you please tell me what to do in english?
I am afraid i don't understand all this computer language

Is virus scan something you do in dos? I am running defragment atm, will this help?

I am not really in the mood to take this to a PC shop, cos they charge a fortune

**reismark** · August 11, 2003, 17:49

Symantec Security Center

http://securityresponse.symantec.com/avcenter/security/Content/8205.html

Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam.

Symantec Security Center

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam.

**Menlas** · August 11, 2003, 17:51

Just had the same problem...I have the solution now.

But it is in french. Only if you are desperate then

Check another forum, I'm sure you'll find the answer in english.

1. Couper toute connexion au net.
2. ctrl+alt+suppr pour avoir le gestionnaire des tâches.
3. s'il y a un processus msblast.exe, le stopper.
4. utiliser la fonction recherche de windows sur msblast.exe et supprimer les 2 endroits où il se trouve (de mémoire : system32 et un répertoire pref???[avec le $ dedans]).
5. lancer regedit (menu démarrer..executer et faire une recherche sur msblast (pas besoin du .exe) et SUPPRIMEZ toutes les occurences (faire Rechercher puis supprimer la 1ère occurence et ensuite F3 pour poursuivre la recherche jusqu'à la prochaine). Ne pas hésiter à supprimer la valeur "windows auto update" dans HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
6. Se connecter au net et suivre le lien http://download.microsoft.com/downlo...80-x86-FRA.exe
pour télécharger le correctif.
7. sitôt téléchargé (donc, dès le début de l'install), couper la connexion internet.
8. terminer l'install du patch et rebooter.
9. vérifier avec le gestionnaire des tâches que msblast.exe n'est plus chargé.

INFO : appliquer le correctif ne suffit PAS ! Il faut virer le msblast.exe car malgré le patch, il se charge toujours en mémoire. Et PURGER la base de registre

**Whaleboy** · August 11, 2003, 17:59

Solution to your problem

**Menlas** · August 11, 2003, 18:03

Translation :

1. Close any internet connection
2. ctrl+alt+del and stop the msblast.exe process.
3. Use the Windows Search function for msblast.exe and delete the 2 (one should be in system 32, the other in a pref... directory).
4. Launch regedit (start menu...execute...regedit) and search for msblast. Delete it, including the "windows auto update" one in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
5. Connect to the net, download the patch (edit : see Andy-Man's post below for the link).
6. Close the connection once the patch is downloaded
7. Install it and reboot
8. Verify in the task manager that msblast is not loaded anymore.

Remark : applying the patch isn't enough, because msblast.exe will still load.

Please note that it is not an "official" solving by MS. It seems to have worked for me though.

**The Andy-Man** · August 11, 2003, 18:19

i found msblast, but it won't let me delete it, so i renamed it to Mb.exe.

but i can't find the 'run' file thing with reg edit the site tells me to sort out

**The Andy-Man** · August 11, 2003, 18:22

i deleted the othe msblast file though, like you said. just not the .exe, which i renamed to hope for the best....

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

I can't find the 'run' bit

**The Andy-Man** · August 11, 2003, 18:23

wait, i did find it

looked under the rong 'windows' bit

**The Andy-Man** · August 11, 2003, 18:31

thx for the help everyone!

I htink (i hope) i have it sorted, i deleted the 2 msblast files, deleted the auto file thing in the regedit part, and apllied the patch.

But does anyone know how i got it in the first place? And how i can avoid it??

thx so much btw

**mark13** · August 11, 2003, 18:35

Thanks for the help so far, but I can't download the French version of the patch - does anyone know where the English one is? I tried changing the last three letters to ENG - to no avail

**The Andy-Man** · August 11, 2003, 18:37

Symantec Security Center

http://securityresponse.symantec.com/avcenter/security/Content/8205.html

Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam.

scroll down a bit to find the link to your system

Announcement

PC help needed BADLY

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment