|
Anonymous
|
 sooo how do I get rid of msblaster?? 
#1808162 - 08/13/03 01:19 AM (20 years, 8 months ago) |
|
|
I picked up this worm just from surfing the internet. I guess I thought I would never get it cause I didn't install the security patch till after I got it. When you try to delete it it won't let you, so I just renamed it and moved it to another folder, but I'm not sure that will even help. What can I do?
|
 daussaulit
Forgetful
Registered: 08/06/02
Posts: 2,894
Loc: Earth
|
Re: sooo how do I get rid of msblaster?? [Re: ]
#1808173 - 08/13/03 01:29 AM (20 years, 8 months ago) |
|
|
If you get a that message pops up telling you that the remote procedure
call service has failed and that my computer will reboot in one minute,
then you probably have W32.Blaster.Worm
Here's information and removal tools if you have the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
If you don't have the worm, protect yourself with this patch.
http://www.microsoft.com/technet/security/bulletin/MS03-026.asp?frame=true
|
Anonymous
|
Re: sooo how do I get rid of msblaster?? [Re: daussaulit]
#1808177 - 08/13/03 01:31 AM (20 years, 8 months ago) |
|
|
Thanks... I was actually just reading the thread about it in OTD. All I had to do was open up task manager and hit End Process so I could delete it.
|
daussaulit
Forgetful
Registered: 08/06/02
Posts: 2,894
Loc: Earth
|
Re: sooo how do I get rid of msblaster?? [Re: ]
#1808183 - 08/13/03 01:33 AM (20 years, 8 months ago) |
|
|
its a little more complicated than that. If you got it once, you can get it again. Removing it from the registry, and then changing the process procedures so it won't shut down your computer.
|
SHiZNO
-
Registered: 03/14/03
Posts: 1,467
|
Re: sooo how do I get rid of msblaster?? [Re: daussaulit]
#1808355 - 08/13/03 03:44 AM (20 years, 8 months ago) |
|
|
type 'shutdown -a' at a command prompt, or the run dialog box, to halt the shutdown proccess, or itll probably shutdown before you can install the patch 
--------------------
...
|
Anonymous
|
Re: sooo how do I get rid of msblaster?? [Re: SHiZNO]
#1809422 - 08/13/03 01:03 PM (20 years, 8 months ago) |
|
|
how do u know if u have this worm? is there like a test u can run
|
Anonymous
|
Re: sooo how do I get rid of msblaster?? [Re: ]
#1810140 - 08/13/03 03:57 PM (20 years, 8 months ago) |
|
|
Look in your \windows\system32\ directory, it puts itself there as a file called msblaster.exe.
|
Anonymous
|
Re: sooo how do I get rid of msblaster?? [Re: ]
#1811034 - 08/13/03 07:41 PM (20 years, 8 months ago) |
|
|
thanks, i dont have it 
|
 Earth_Droid
Stranger
Registered: 04/19/02
Posts: 5,240
Last seen: 17 years, 8 months
|
Re: sooo how do I get rid of msblaster?? [Re: ]
#1811040 - 08/13/03 07:43 PM (20 years, 8 months ago) |
|
|
lol, I just got the same one. I ran a system restore before I knew it was a virus. I just removed the virus completely now though.
|
Jellric
altered statesman
Registered: 11/07/98
Posts: 2,261
Loc: non-local
|
Re: sooo how do I get rid of msblaster?? [Re: ]
#1814382 - 08/14/03 04:46 PM (20 years, 8 months ago) |
|
|
I learned today I have it and I removed it manually by stopping its process as you mentioned, then deleting the registry key it created to enable it to start itself when your windows starts, then I deleted the msblast.exe file which was in my WINNT/system32 folder. Finally I downloaded the patch from microsoft. com. BTW, did anyone notice that the microsoft site didn't give the full text of the message included in the worm? It had a little dig at Bill Gates.
I'm glad this thing is gone. Was wondering why I couldn't copy and paste sometimes when here on the Shroomery and certain links were no longer clickable.
--------------------
I AM what Willis was talkin' bout.
|
Jellric
altered statesman
Registered: 11/07/98
Posts: 2,261
Loc: non-local
|
Re: sooo how do I get rid of msblaster?? [Re: Jellric]
#1814444 - 08/14/03 05:06 PM (20 years, 8 months ago) |
|
|
What the hell? The damn thing is back!! I deleted it and applied the patch, restarted my computer. I thought the patch would prevent a reoccurance. Do I have to close the ports it's operating through or what?
--------------------
I AM what Willis was talkin' bout.
|
daussaulit
Forgetful
Registered: 08/06/02
Posts: 2,894
Loc: Earth
|
Re: sooo how do I get rid of msblaster?? [Re: Jellric]
#1814860 - 08/14/03 07:03 PM (20 years, 8 months ago) |
|
|
did you follow the instructions at the symantec link I posted earlier? It worked for me, and hasn't come back.
|
Jellric
altered statesman
Registered: 11/07/98
Posts: 2,261
Loc: non-local
|
Re: sooo how do I get rid of msblaster?? [Re: daussaulit]
#1814938 - 08/14/03 07:24 PM (20 years, 8 months ago) |
|
|
Yes, I followed them carefully. I restarted my computer again, and maybe I didn't restart after applying the patch. I thought I did, but maybe not. Anyway, it's gone, and I also installed a freeware firewall program that I used to use called Sygate Personal Firewall.
--------------------
I AM what Willis was talkin' bout.
|
Earth_Droid
Stranger
Registered: 04/19/02
Posts: 5,240
Last seen: 17 years, 8 months
|
Re: sooo how do I get rid of msblaster?? [Re: Jellric]
#1814946 - 08/14/03 07:26 PM (20 years, 8 months ago) |
|
|
You have to apply the patch first. Just run the removal program again, I am sure it will be fine.
|
riffic
Registered: 09/12/02
Posts: 99
Last seen: 10 years, 1 month
|
Re: sooo how do I get rid of msblaster?? [Re: Earth_Droid]
#1815294 - 08/14/03 09:25 PM (20 years, 8 months ago) |
|
|
your system has been root-level compromised. from a security standpoint, you really should format your drives and install from clean media, backing up any non-executables while you can.
be sure to read my thread in the security and safety forum while you can. it got a little heated but I still stand by my comments.
|
|
Threaded
Previous
Index
Next
Shop: Buy Bali Kratom Powder, Maeng Da Thai Kratom Leaf Powder
Edit 
Reply 
Oatman2000
Sheepish
OJK
1 2 all )
DieCommie
grassman
daytripper05