Fixing a friend's computer infected with MSBLAST worm - PLEASE HELP!!!

[waylman]

I'm trying to install the MS Patch that gets rid of this bad boy, but when it starts to install it just minimizes and closes out. So, I cannot install the patch. It is driving me crazy! I googled this but came up empty. Anyone have any advice? Thank You!!!
PS. NAV also will not run...it does the same thing. Just closes out on its own.

 

[Jgtdragon]

Do it in regedit. Go into the registy and clean out msblast.

 

[y2kc]

download fixblast from symantec's site (on another comp if necessary, it'll fit on a floppy), disconnect puter from the internet, run the fix (which will delete all instances of the virus on the PC). patch system.

 

[dakata24]

msblast.a removal instructions

msblast.d removal instructions

 

[waylman]

Im freaking out!!!!!!! This thing must be some mutant of the MSBLAST b/c I can't do anything. The Symantec tool does find anything. When I go to regedit it shuts down immediately. When I go to Windows Update, PC reboots. The removal instructions just aren't working!!!

 

[atom]

So are you sure it's the blaster worm? Doesn't sound like it, unless it's a new variation.

 

[waylman]

yeah, b/c I get that stupid error "The RPC terminated unexpectedly...computer is rebooting in 45 seconds"

 

[oniq]

Are you booting into safe mode?

 

[waylman]

no, i'll try that though

 

[RMSistight]

You are suppose to disable System Restore first, before running the Fixblast scanning program on the Symantec website.

 

[MAME]

Duh, boot in to safe mode and just delete the file(s)

 

[waylman]

yeah, i disabled system restore. thanks for the tips all

 

[Jgtdragon]

Try this, go to services and locate RPC -> advance tab- set everything to take no action instead of restarting.

 

[Howard]

format c:

 

[bleeb]

Originally posted by: Howard
format c:

hahah nice.... that's the MOST effective way.

 

[Harvey]

Go to Norton's page about Blaster, and read the removal instructions. Also, download their removal tool, here.

There are a number of varients (Blaster, Blaster.A - Blaster.F), so figure out which one(s) you have, and take it from there.

 

[Viper22]

Originally posted by: waylman
yeah, b/c I get that stupid error "The RPC terminated unexpectedly...computer is rebooting in 45 seconds"

Is this happening even with the system off the net? If so it sounds like one of the W32.HLLW.Gaobot variants thats out there. Boot into safe mode to install the patch than run a full virus scan with updated definitions.