S
Sarkis Demirdjian
People affected with this virus don't have a lot of time
to act on what to do with this virus due to the constant
reboots that the RPC window pop up does by shutting you
down. Read these steps or print them out somehow,
because you might get rebooted right about NOW.
1) UNPLUG YOUR MODEM. This should allow you free time
to make some changes to your computer (after you reboot,
if your RPC window pops up and requires you to do so).
2) When you are not connected to the Internet, go
to "Control Panel," "Performance and
Maintenance," "Administrative Tools," open "Services,"
right click on "Remote Procedure Call,"
click "Properties," click the "Recovery" tab, at "First
Failure," "Second Failure," and "Subsequent Failures,"
select "Take No Action."
3) Turn on your modem and reconnect to the Internet.
4) At this stage, you are still infected with the
msblast virus, but your computer should not reboot on you.
5) This virus is very clever and has disabled several
buttons on the web and on your computer that would
otherwise allow you to disable it, so you've got to go
around the back door.
6) From support.microsoft.com, download:
WindowsXP-KB823980-x86-ENU.exe
(this is for XP; there is a Windows 2000 version
also...try a search on the Microsoft Support
website...plugging in this file name should bring you to
the same page as the security patches for the other
Windows versions).
7) Download and install.
8) Reboot.
9) Now you should be able to have a little more
functionality in your computer. If you haven't done so
already, enable your firewall:
"Control Panel," then "Network and Internet Connections,"
then "Network Connections," right click on your active
Internet connection, select "Properties," click on
the "Advanced" tab, and check the box enabling firewall
protection.
10) The virus should be removed with the microsoft
patch. If not alternate steps would be to go to:
http://housecall.trendmicro.com/housecall/start_corp.asp
It's a free anti-virus detection and cleanup program.
Preferrably update your Anti-virus program, I know Norton
came out with the patch remover so do a look up on
Symantec.com for the removal tools. Plus update your
definitions and do a system scan to remove the virus.
11) To be sure, run the Search program from your Start
menu. Search for "msblast.exe" Include all hidden files
and folders in your search. If you have been successful,
no files will appear. Otherwise it should be located in
the C:\Windows\System32 folder. Get rid of it. If you
can go into your systems registry by going to Start, then
Run, and type in regedit. Do a search by going to edit,
then find, and type in mblast.exe. Remove all instances
of the virus, usually should be located in the Run folder
along with the other files that start up with Windows.
13) Congratulations! You're cured! Keep all critical
updates current and be aware for future attacks.
Remember! Only systems with Windows NT, Windows XP, and
Windows 2000 are affected with this virus.
Any other questions can be made to (e-mail address removed)
to act on what to do with this virus due to the constant
reboots that the RPC window pop up does by shutting you
down. Read these steps or print them out somehow,
because you might get rebooted right about NOW.
1) UNPLUG YOUR MODEM. This should allow you free time
to make some changes to your computer (after you reboot,
if your RPC window pops up and requires you to do so).
2) When you are not connected to the Internet, go
to "Control Panel," "Performance and
Maintenance," "Administrative Tools," open "Services,"
right click on "Remote Procedure Call,"
click "Properties," click the "Recovery" tab, at "First
Failure," "Second Failure," and "Subsequent Failures,"
select "Take No Action."
3) Turn on your modem and reconnect to the Internet.
4) At this stage, you are still infected with the
msblast virus, but your computer should not reboot on you.
5) This virus is very clever and has disabled several
buttons on the web and on your computer that would
otherwise allow you to disable it, so you've got to go
around the back door.
6) From support.microsoft.com, download:
WindowsXP-KB823980-x86-ENU.exe
(this is for XP; there is a Windows 2000 version
also...try a search on the Microsoft Support
website...plugging in this file name should bring you to
the same page as the security patches for the other
Windows versions).
7) Download and install.
8) Reboot.
9) Now you should be able to have a little more
functionality in your computer. If you haven't done so
already, enable your firewall:
"Control Panel," then "Network and Internet Connections,"
then "Network Connections," right click on your active
Internet connection, select "Properties," click on
the "Advanced" tab, and check the box enabling firewall
protection.
10) The virus should be removed with the microsoft
patch. If not alternate steps would be to go to:
http://housecall.trendmicro.com/housecall/start_corp.asp
It's a free anti-virus detection and cleanup program.
Preferrably update your Anti-virus program, I know Norton
came out with the patch remover so do a look up on
Symantec.com for the removal tools. Plus update your
definitions and do a system scan to remove the virus.
11) To be sure, run the Search program from your Start
menu. Search for "msblast.exe" Include all hidden files
and folders in your search. If you have been successful,
no files will appear. Otherwise it should be located in
the C:\Windows\System32 folder. Get rid of it. If you
can go into your systems registry by going to Start, then
Run, and type in regedit. Do a search by going to edit,
then find, and type in mblast.exe. Remove all instances
of the virus, usually should be located in the Run folder
along with the other files that start up with Windows.
13) Congratulations! You're cured! Keep all critical
updates current and be aware for future attacks.
Remember! Only systems with Windows NT, Windows XP, and
Windows 2000 are affected with this virus.
Any other questions can be made to (e-mail address removed)