HOW TO REMOVE THE RPC VIRUS

[Paul Anderson]

Hi folks,

FIRST THINGS FIRST...I know you don't have a lot of time
before your RPC window pops up and shuts you down, but
because you will be disconnecting from the internet for
part of this procedure, read this fast and REMEMBER!

1) UNPLUG YOUR MODEM. This should allow you free time
to make some changes to your computer (after you reboot,
if your RPC window pops up and requires you to do so).

2) When you are not connected to the internet, go
to "Control Panel," "Performance and
Maintenance," "Administrative Tools," open "Services,"
right click on "Remote Procedure Call,"
click "Properties," click the "Recovery" tab, at "First
Failure," "Second Failure," and "Subsequent Failures,"
select "Take No Action."

3) Turn on your modem and reconnect to the internet.

4) You've probably run out of time reading this before
your computer has rebooted, so get back to this message
and read from step 5 on. At this stage, you are still
infected with the msblast virus, but your computer will
not reboot on you.

5) This virus is very clever and has disabled several
buttons on the web and on your computer that would
otherwise allow you to disable it, so you've got to go
around the back door.

6) From support.microsoft.com, download:
WindowsXP-KB823980-x86-ENU.exe
(this is for XP; there is a Windows 2000 version
also...try a search on the Microsoft Support
website...plugging in this file name should bring you to
the same page as the security patches for the other
Windows versions).

7) Download and install.

8) Reboot.

9) Now you should be able to have a little more
functionality in your computer. If you havent' done so
already, enable your firewall:
"Control Panel," then "Network and Internet Connections,"
then "Network Connections," right click on your active
internet connection, select "Properties," click on
the "Advanced" tab, and check the box enabling firewall
protection.

10) Now let's kill the virus. Go to:
http://housecall.trendmicro.com/housecall/start_corp.asp
It's a free antivirus detection and cleanup program.

11) Run the program (this takes a long time). The
program should detect the msblast virus; it states that
it is non-cleanable. Click the "delete" button to delete
the virus.

12) To be sure, run the Search program from your Start
menu. Search for "msblast.exe" Include all hidden files
and folders in your search. If you have been successful,
no files will appear.

13) Congratulations! You're cured! Now download all the
security patches and updates that Microsoft bugs you
about everytime you boot your computer...I have been
ignoring it for months and this is what happened.

(Hey Mr. Gates, you can pay me by cash, check, or charge
for consulting services offerred. You're welcome.)

Let me know how it works out for you! Good luck!

Paul
(A Graduate Student who managed to figure it out without
spending ridiculous money on tech support fees...this
goes out to my peeps)

[Thomas O'Grady [MSFT]]

Thank you Paul for being a good citizen. Just one minor correction, the call
to MSFT is free.

But, i don't want that to take away from your contribution.

For everyone
If you are using Windows NT 4.0, Windows 2000, Windows XP, or Windows Server
2003, you should follow these steps to help protect your system:
1.. Make sure you have a firewall.
a.. If you have Windows XP or Windows Server 2003, enable the Internet
Connection Firewall (ICF).
b.. If you have Windows 2000 or Windows NT, visit Windows Catalog for a
list of Internet firewall software.
2.. Get the latest critical updates for the version of Windows that you
are using and make sure you get the update addressed in Security Bulletin
MS03-026.
3.. Make sure you install and use antivirus software.
a.. If you have antivirus software installed, get the latest virus
definitions from your antivirus vendor's Web site.
b.. If you do not have antivirus software installed, visit Windows
Catalog for a list of antivirus software vendors.
What to Do If You Think Your Computer Has Been Infected
If you think your computer has been infected with the Blaster worm, please
contact Microsoft Product Support Services or your antivirus vendor for
assistance removing it.

a.. For Microsoft Product Support Services within the United States and
Canada, call toll-free (866) PCSAFETY (727-2338).
b.. For Microsoft Product Support Services outside the United States and
Canada, visit the Product Support Services Web page.

--
Thomas O'Grady,
Security Business Unit
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

"Paul Anderson" <chr...@ufl.edu> wrote in message
news:088201c3609a$a7938980$a501...@phx.gbl...

[Alan Kotyk]

Hey, Paul,
I'm going crazy trying to figure out why i can't get this
cleaned up.
It is near IMPOSSIBLE to get thru to those losers at
microsoft for any advice, unless you want to sit on the
phone for 20 minutes at $3.00 per hr.
I want to thank you for this posting. Lets hope it works.
Thanks,

>.
>

[Mary]

I did what you said, and did the Take no action on all
for the RPC, then when I went back in, as you said it did
not kick me off at that time as it did before. But, I
got to the Windows support page and told it to install
the upgrades and it just sat there and did not do a
thing. I kept getting the message from Norton that I had
the virus. I caught it on the system scan, but it, not I
can delete it from my System directory.
I do not know how to get the patch because I cannot get
microsoft to install it. HELP!!

>.
>

[Vish]

does work..,Thanks!

>.
>

[Patty]

Thomas

I appreciate you postiing the 1-866-PCSAFETY number to
call. However, I have been dialing this number for two
days and continue to get a busy signal. Does Microsoft
think that this one number is going to service everybody
who is having problems with viruses. I read today that
69% of all computers operating in the U.S. are suffering
from viruses. I would like to tell Bill to come up off
some of those billions and install more phone services
for his patrons.

>.
>