Printable View
http://www.dodstudios.net/uploads/up...bigproblem.jpg
the only reason it says 152 days is because i changed the date on my machine back a few months
i keep getting this error message whenever i play a game or use kazaa ect...and it is really getting under my skin. this thing pops up and says i have 60 seconds to log off, then my machine reboots :confused: i included a shot of a netstat i did to see if someone is doing this to me. please help this hopeless noob out =]
I saw this on two machines today since msblast.exe worm has been coming out. See if you have c:\windows\system32\msblast.exe in that directory. If you do, go into its properties and uncheck read only and then delete it.
It runs itself from \HKEY-Local Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and calls itself Windows Auto Update.
This fixed both of my clients machines machines that were having the same problem. If something else is causing it, I am not sure yet.
yeah it was that msblast.exe thing. i deleted it from my reg but whenver i try to delete the file from windows/system32 it keeps telling me access is denied
Your best bet is to delete the key from the registry given above. Reboot. Find the file in explorer or my computer...right click on it. Uncheck read only. delete it
nope, that still wont delete it
ok i delted it but it still pops up. my anger level slowly rises
Hi!
The solution posted by Grinler dont work 'cause is a worm and even your have luck and delete msblast.exe, your PC could be infected again. I post a solution at http://www.antionline.com/showthread...294#post652135
Maybe it could be a efective solution.
The most important: BLOCK TCP PORT 135!!
See u!
Groby
Like everyone has mentioned msblast is the culprit, however my roommate had msconfig35.exe on his system, located in %systemroot%\system32 and it seemed to be the problem with his machine.
I haven't seen this posted yet on here (if I'm wrong, feel free to correct me) but another option, to elminate the shutdown screen (incase it's not msblast.exe but a variant) is to go to Administrative Tools --> Services --> Remote Procedure Call (RPC) --> Recovery Tab --> Change First Failure, Second Failure and Subsequient Failures to Restart the Service, isntead of restart computer.
I disagree with your post grobyccil on how to remove this worm. I think reinstalling because of this worm is definitely unnecessary. Granted if you were vulnerable to the worm, then you could have been hacked previously, but to reinstall just because of the worm is over kill.
The only solution to this exploit is patch your computers so your not vulnerable. Delete the registry key. Delete the file. SImple as that.
I think most people will not have problems removing the worm and reinstalling is way overkill.
i deleted the file from the reg and system32. but the mother ****er keeps coming back. im utterly hopeless
i cant even breathe im so frustrated. i think im going to have to delete windows
Maybe Grinler but there are other things aside from this worm exploding the RPC vuln and you never know if you have an backdoor or no. I think that if your system is hacked, is reasonable to begin of zero. I have seen many rootkits...
I'm agree in patch the PC, but I am a litle paranoic man... ;)
i cant run my virus scanner or windows updates
Hope you have a backup of important files. The best solution is to cut your losses and start over, if you can. That's the only way to know for sure that you have gotten rid of it. Sounds nasty. Someone here may have better advice, but I'm just telling you what I'd do. :brickwall:
Blaster just upgraded to a Cat-4.. 08:50 UTC
Only panic if you don't have access to a clean, patched, firewalled system..
Follow removal instructions from Symantec
This page includes links to download a removal tool, and the Patch..
NOTE: Follow the Bloody Instructions especially the step about disabling the system Restore.. If you don't do this it will come back.. and follow the instructions
If you don't like Symantec (Norton) you could try Sophos for instructions ..Quote:
Read instructions on how to remove the W32/Blaster-A worm and ensure your system is not vulnerable to reinfection.
Or try the info from McAfee (Lovesan=MSBlaster) ..Also info from F-Prot ..And Bitdefender ..And Authentium (aka Command.com AV) .. Oh and Panda .. Oh and TrendMicro .. And Leprechaun .. M$'s RAV .. I hope you don't need help from Kaspersky ..
I think you get the hint.. Clean/Patched/Firewalled(port135, 4444 and all other un-need ports Blocked) Machine.. to get the info, tools and patches.. and follow the instructions..
Cheers
BTW: Dosen't anyone do some sort of a search b4 posting?.. the number of treads on different forums on this site, regarding this bug.. while some it is understandable they didnt know what was happening.. ..
Opps i think I have given out my secret for all the Heads Up warnings.. This Listing is just those who listed the Lovesan/MSBlaster worm in their warnings.. Noobs.. bookmark them....
BTW: Dosent anyone do some sort of a search b4 posting?.. the number of treads on different forums on this site, regarding this bug.. while some it is understandable they didnt know what was happening.. ..
I still think its unnecessary to do a complete reinstall of your system,
which may be a very costly or difficult thing to do for the common lay
person.
I would follow the steps that Symantec gives from the following link:
Symantec
What they dont say on the manual removal is that the file has the attribute of read online. You need to right click on c:\windows\system32\msblast.exe or c:\winnt\system32\msblast.exe and uncheck the read only check mark. Then after the process is terminated you can delete the file.
I do agree that if you had this security hole for as long as its out, there is a risk that there may be other hacks on your computer.
I wrote a tutorial on how to determine if you have some of these hacks. It wont cover everything but does cover a great deal.
The tutorial can be found at: Windows Forensics: Have I been hacked?
Hope this helps.
thanks guys :)
i got rid of the worm around 3 am this morning. if i knew how give out anti points i would
http://securityresponse.symantec.com...oval.tool.html there you can download the removal tool and dont forget to update windows i read in a site that microsoft already has a Patch
http://www.globetechnology.com/servl...ry/Technology/
>>i got rid of the worm around 3 am this morning.
Im glad you got rid of the darn thing. Lucky im running Win 98 and does not seem to be afected.
I would just like to say I was just down stairs fixing my friends XP computer, he had the blaster worm, and was getting the RPC shutdown. I fixed it by downloading a patch http://support.microsoft.com/?kbid=823980#WinXP
But now as I read this I see I was suposed to also delete mblaster.exe, I will inform my friend.
good job all of those that helped :)Quote:
Originally posted here by Simo
thanks guys :)
i got rid of the worm around 3 am this morning. if i knew how give out anti points i would
I have gotten that shut down message ONCE.... and that was a few weeks ago, while playing counter-strike. and never again *knock on wood*. But once a day I do get a pop up about updating my windows, but when i click "more" its just some advertisement....and its an update message from comcast *my internet provider* so was what I got an actual error my comp had...or you think its the virus. And I dont have msblast.exe anywhere in my comp.
One thing you have to keep in mind with Win XP is before you remove anything to turn off XP's system restore function. If you do not do that and are infected XP will put back the infection. LOL another customer want to have by M$ Dah guess they did not think that out fully like many things.
Peace
;)
Dear Ones:
My XP box also got the same problem, i taught of requesting here, but when i searched i found this posts are pretty helpfull, thanks for all the advice my system is safe now
regards
prem
I may be a little late in posting to actually do any of you much good....
I found this site very helpful, it explains how to disable the system shutdown long enough for you to download the patch and removal tool.
http://www.blackviper.com