How do I recover?
Omer Hayden
shut down about 5 minutes after startup. I went to the MS
site and downloaded Service Pack 1 for my windows xp. In
the middle of installing the patch I got the countdown
warning and the system shut down again before the install
was complete. Now my computer turns on for 10 to 15
seconds, starts the start up routine, shuts off and begins
again.
My question is: How do I recover from this?
![Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]'s profile photo](http://lh3.googleusercontent.com/a-/ALV-UjVWEHNriBiYPzXk-vgDPwHLgmiXqqoZ_BdoNm0rTxa-ZYFnAw=s40-c)
Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
FIRST THINGS FIRST...I know you don't have a lot of time
before your RPC window pops up and shuts you down, but
because you will be disconnecting from the internet for
part of this procedure, read this fast and REMEMBER!
1) UNPLUG YOUR MODEM. This should allow you free time
to make some changes to your computer.
2) When you are not connected to the internet, go
to "Control Panel," "Performance and
Maintenance," "Administrative Tools," open "Services,"
right click on "Remote Procedure Call,"
click "Properties," click the "Recovery" tab, at "First
Failure," "Second Failure," and "Subsequent Failures,"
select "Take No Action."
3) Turn on your modem and reconnect to the internet.
4) You've probably run out of time reading this before
your computer has rebooted, so get back to this message
and read from step 5 on. At this stage, you are still
infected with the msblast virus, but your computer will
not reboot on you.
5) This virus is very clever and has disabled several
buttons on the web and on your computer that would
otherwise allow you to disable it, so you've got to go
around the back door.
6) From support.microsoft.com, download:
WindowsXP-KB823980-x86-ENU.exe
(this is for XP; there is a Windows 2000 version
also...try a search on the Microsoft Support
website...plugging in this file name should bring you to
the same page as the security patches for the other
Windows versions).
7) Download and install.
8) Reboot.
9) Now you should be able to have a little more
functionality in your computer. If you havent' done so
already, enable your firewall:
"Control Panel," then "Network and Internet Connections,"
then "Network Connections," right click on your active
internet connection, select "Properties," click on
the "Advanced" tab, and check the box enabling firewall
protection.
10) Now let's kill the virus. Go to:
http://housecall.trendmicro.com/housecall/start_corp.asp
It's a free antivirus detection and cleanup program.
11) Run the program (this takes a long time). The
program should detect the msblast virus; it states that
it is non-cleanable. Click the "delete" button to delete
the virus.
12) To be sure, run the Search program from your Start
menu. Search for "msblast.exe" Include all hidden files
and folders in your search. If you have been successful,
no files will appear.
13) Congratulations! You're cured! Now download all the
security patches and updates that Microsoft bugs you
about everytime you boot your computer...I have been
ignoring it for months and this is what happened.
(Hey Mr. Gates, you can pay me by cash, check, or charge
for consulting services offerred. You're welcome.)
Let me know how it works out for you! Good luck!
Paul
(A Graduate Student who managed to figure it out without
spending ridiculous money on tech support fees...this
goes out to my peeps)
Omer Hayden wrote:
--
"Don't lose sight of security. Security is a state of being,
not a state of budget. He with the most firewalls still does
not win. Put down that honeypot and keep up to date on your
patches. Demand better security from vendors and hold them
responsible. Use what you have, and make sure you know how
to use it properly and effectively."
~Rain Forest Puppy
http://www.wiretrip.net/rfp/txt/evolution.txt
omer
actually turn on. It now shuts off after 10 to 15
seconds. I don't have time to get to the internet. My
desktop doesn't even come up. Any suggestions to get past
that?
Omer Hayden
>
G.R.
MS screwup??
>
Antnee
when the PC is connected the worm 'Blaster' is trying to
connect out and spread to other machines. Disconnecting
from the web will stop this. Your PC crashes and reboots
when it generates illegal IPs (Or at least, IPs that
don't exist or are blocked) This is why your PC is
rebooting.
Click on START, then click RUN, type in MSCONFIG. Click
on OK. Now click STARTUP. Look for WINDOWS AUTO UPDATER
or MSBLAST and untick it. Reboot the machine. DO NOT
RECONNECT THOUGH YET.
Set your Firewall to block TCP and UDP on ports 135, 139
and 445, now you are safe to connect and if necesary
download the required patch.
See http://www.visualante.org/msblast for more info
>.
>
Denise
I have this same problem and I see many others have the
same problem, but I see know answers?? Am I missing
somthing or is this just a place to chat about our
problems with no help or solutions??
>
Daniel Hawthorne
Personally I think Microsoft could make this issue alot
clearer but there's not alot I can do about that.
There are however plenty of people around trying to help.
I'm in the UK, I was up at 6 this morning, it's nearly
midnight and I'm trying to help people where I can.
To get rid of the virus, follow the link below or the
instructions
http://vil.nai.com/vil/content/v_100547.htm
1. Start your computer but DO NOT connect to the
internet.
2. Hold down the ctrl , alt & del keys, and choose
task manager.
3. Click on the 'processes' tab, find msblast.exe in
the list, highlight it and click 'End Process'.
4. Connect to the internet, either go to
www.microsoft.com and download the MSBlast critical patch
manually or go to windowsupdate.microsoft.com and
download all critical updates. N.B. for windows 2000 you
must already be running service pack 3 for windows.
5. Install the patch and let it restart the
computer.
6. Go to www.symantec.com or similar and download
their MSBlast Virus removal tool. Run this and let it
delete the virus.
7. You should now be clear of the virus and unable
to be infected again.
These instructions were written in a hurry so I can't
guarantee everything is 100%.
>.
>
Denise
paid by MSFT for your time... Anyway I tryed all the
below today and my computer shuts down before i can
complete the download. I wonder if I can just get a disc
from MSFT and do it later?
>
Cheryl Fischer
Here is a link that looks really good in terms of detailed instructions on
how to "buy time" on your system so that you can begin repairs.
http://www.visualante.org/msblast/
Look for this text about 1 page down: "alternatively you can extend the
amount of time that Windows gives you until it reboots by following the
instructions HERE"
--
Cheryl Fischer
Law/Sys Associates
Houston, TX
"Denise" <dbr...@earthlink.net> wrote in message
news:04cf01c36126$63e269e0$a501...@phx.gbl...
Daniel Hawthorne
Try these instructions instead. They were my original
instructions (I've actually had to do this once on a
friend's already) but I changed them slightly due to what
other people were saying. I'm not so sure they were right
now.
1. Start your computer but DO NOT connect to the internet.
2. Click on the Start Menu and then click on Run. Enter
services.msc and hit enter.
3. Scroll down to the 'Remote Procedure Call(RPC)' line
and double click on it.
4. Click on the 'Recovery' tab. Change First, Second and
subsequent failues from 'Reboot the computer' to 'Take no
Action'
5. Click 'OK' and then close the services window.
6. Now restart the computer
7. Connect to the internet, either go to
www.microsoft.com and download the MSBlast critical patch
manually or go to windowsupdate.microsoft.com and
download all critical updates. N.B. for windows 2000 you
must already be running service pack 3 for windows.
8. Install the patch and let it restart the computer.
9. Go to www.symantec.com or similar and download their
MSBlast Virus removal tool. Run this and let it delete
the virus.
10. You should now be clear of the virus and unable to be
infected again.
>.
>
|{evin
>I have the exact same problem now. What do we do to fix
>MS screwup??
Well, first of all.. you could lose the attitude. Microsoft announced
the vulnerability and released the patch a while back. Just because
you're too stupid to secure your computer doesn't make it Microsoft's
fault.