All Windows NT/2K/XP/2003 Users, Very Important Message

[Hueij]

Originally posted by panag
hi ,

panag points out the link from above , .....

>>>> http://www.microsoft.com/technet/tr...in/MS03-026.asp


have a nice day

Well, this is what I get from your link. So my question still stands...

[Zopperoni]

Odd, the link still works for me.

Edit: I see the error now. Panag just copied the text of the link, instead of the link itself.

Click here, H, and you can read the page: http://www.microsoft.com/technet/tre...n/MS03-026.asp

[Whaleboy]

I think the virus does something like a DDoS attack on the fixing thing, this error might be it, I dont know.

[Zopperoni]

No, click on the link that Panag gave Hueij and then look at the address bar of your browser.

And about the worm being a DoS, yes, that is true, it blocks the update site, which is why Cinch wasn't able to patch earlier.

[cinch]

Well, I seem to have it contained.

Just running fixblast.exe was not enough. I had to kill the trojan first (ctl alt del and all that), and then that bought me some time to download the updates & patches.

I had to disable system restore, too. That was very important. It was keeping the thing alive.

After all that, I just disconnected the internet, ran fixblast again, and deleted the files it found. Then, I reconnected and rebooted, and it seems to have half-disappeared. I still get weird 'cannot open such and such a file' notices when I start up windows, but msblast.exe itself (the thing that makes my computer automatically reboot) does not seem to have survived.

I think it's still dwelling in here somewhere, and it could return, but at least I have it under control now.

Thanks to everyone who posted info and such in this thread!

[TCO]

Heeeeeelp mee!!!!!

[TCO]

1. Ashie. I am on the sysadmin page. Do I have 32bit or 64bit XP. I have XP home. The Washington Post process sends me to that same page.

2. The Washington Post thing is good. But it lies. The msblast is a process not an application. You have to go to applications to kill it.

3. I'm scared to do the Firewall part so I'm blowing that off.

4. I tried (before Washington Post) going to windows update but that doesn 't work. If anything it triggers the shutdown.

[TCO]

Ok...to simplify is windows XP home a 32 bit or 64 bit XP?

[mrmitchell]

You've probably got 32bit. Unless you're running on some server or something. I'm sure Ash knows the obscure dialogue that tells you exactly your version, build, shoe size, and whatnot.

IIRC the trojan kills the Windows Update program that automatically downloads these things for you. Try going to the technet page or something.

[TCO]

crap I am still infected. Frigging windows.

[TCO]

I'm dying in here.

[Q Classic]

windows xp home and professional, including the volume license versions, are the 32-bit versions of windows.

the 64bit version is used only in datacenters and for niche applications, and isn't sold preinstalled or at any computer store...

go to the symantec website to clean it off.

http://securityresponse.symantec.com/avcenter/FixBlast.exe

then download the patch from microsoft

[TCO]

crap, the symantec thing shut down. And what is the Windows patch? Which specific thing are you reffering to? I've been directed to download a Xp32 bit file. But also to run Windows update.

[TCO]

No joy. The symantec thing shuts down in the damn middle.

[Q Classic]

the symantec thing shut down as it stopped working?

hmm... ok.

download the symantec file to your root c: folder.
then, download this patch from microsoft.
then, right click on the "My Computer" icon, whether it's on your desktop or in your start menu, and choose "properties". go to the system restore tab, and click the check box that says "turn off system restore for all drives".

reboot the computer, and right before the windows xp boot screen comes up, mash f8 repeatedly, and select "safe mode", and then run the program again.

allow it to clean everything out, and then reboot the computer and go back into the full windows; run the patch.

turn system restore on again.