crazy computer problem HELP! :(

[QueBert]

my friends PC is infected with Blaster virus.

I downloaded the patch from MS but it won't install, I don't get an error, the box just goes away after I click "next" and "agree"

msconfig also blanks out. I got it to run avast cleaner and it detected blaster as msblaster and mslaugh, it removed the files, but her system still gets the RPC and it shuts down. I'm unsure why I can't get msconfig to stay open or the MS patch, any other ideas??

also when I try to do windows up I get "your current security settings prohibit running activex controls on this page" I checked in the internet settings and activex was set up to allow access, I even tried lowering the security but I still get the message. Could this somehow be tied into the blaster virus?

lastly I'm getting aSetup could not verify the integrity of the file. Make sure the Cryptographic service is running on this computer.
I read up on MS knowledge base, I did exactly what they said. Then I googled and went threw a process of stopping the crypto service renaming the catroot and restarting the crypto service then trying to reinstall it, still no luck

this is when I try to run the MS blaster patch. I checked msconfig + c+a+d and the file isn't in memory where I can see it.

thanks

 

[mechBgon]

I suggest starting by isolating the computer from the network/Internet connection, if you haven't already. Disable WinXP's System Restore feature and delete all the System Restore files (how do I do that?).

Using an uninfected computer, download McAfee's Stinger tool from here and the necessary patch from Microsoft here, and free ZoneAlarm firewall software from here, and burn them to a CD.

Now start the infected PC and apply the patch from CD. Next, run Stinger. Afterwards, get ZoneAlarm installed and keep the world the heck outta your computer 😀 Hope that helps!

Oh, and get some antivirus software (duh). You can get Grisoft's AVG Free Edition at http://www.grisoft.com, it's permanently free and evidently pretty good too. Make sure it updates its virus database daily, you don't want your AV software operating on "yesterday's news." If the system keeps thwarting you, then you may want to just reformat the hard drive and start from the top.

 

[QueBert]

thanks for the reply I appericate the idea. She doesn't have access to a CD with the utilities, I've been using remote desktop to connect to her PC. I can just burn a CD and send them too her, I was under the assumption if I ran Avast Cleaner and it kicked the virus out the memory it would allow me to clean the rest of the system up.

Could Blaster be what's causing her PC to report that ActiveX is disabled? I have seen Blaster many times myself on different PC's I've fixed. but I've never seen this AX issue, couldn't find any info on it when I googled either. 🙁

thanks again for the help, I'm burning the cd as we speak 🙂

 

[mechBgon]

I don't know for sure if the AX problem is arising from the virus or not. If you've had to remove it from PCs before, you've got more real-world experience with it than I do 🙂 The only PC it's tried to get into was an employee's home-office PC and McAfee VirusScan Enterprise kept saying "uhhhh... NO." and killing it, as the logs revealed when I got out there.

 

[QueBert]

haha I'm a real world tech and when blaster hit I struck it rich. As for this PC, I'm baffled, because I'll run the cleaner, it will find the virus's in memory and clean them out, and find them on the HD and clean them out. Then when I go to do a deep scan with Avast the RPC box pops up and it reboots. I might have to just drive out to Long Beach to help her.

 

[nork]

could it be that this particular version of blaster also left registry entries that are causing the probs?
If that is a possibility, i wonder which words to use to do a registry search?

I run goback and the few times i have got a virus, goback has taken care of it, so i havent had to learn about virii much.