worm

[rcj187]

ok i know this is the wrong forum for this but.....
a friend of mine got that damn worm few days ago.. now she is trying to install the patch from the ms website but it wont run, it keeps saying something about a cryptographic service?? anyone have any idea what this is about? shes on winxp. please help me out here

 

[craqon]

The worm prevents the updating process. Press Ctrl-Alt-Del and kill the msblast.exe process. Now try updating it again.

Or get the removal tool from www.symantec.com

That kills the process and deletes all the registry keys, but it doesn't prevent you from being infected again if your on a network.

Want to get laid??? Crawl up a chicken's butt and wait.

 

[rcj187]

thanx but ive already done all that.. i got the removal tool from symantec and now i want to put the patch on to stop it happening again ut its not playing nice 😱(

 

[craqon]

My guess is you're on a network.... And you keep on getting infected... He he.

2 options. Unplug your hub. Or disable any and every share. That includes printers. Then use the tool. What helped for us was to goto Dos and do a deltree c:\recycled. The virus hides there as well. Don't worry. Windows recreates that folder again at reboot. There is a few other things that slips my mind at the moment. Then also use msconfig at START>RUN and disable the service. Restart and use the tool. And install a good AntiVirus program. Norton 2002 worked fine for us. Trend not.

Good luck

Want to get laid??? Crawl up a chicken's butt and wait.

 

[rcj187]

its not my comp andshe isnt on a network but she is on broadband so maybe as fast as norton can knock it off its just getting reinfected.. ill try disconnecting the broadband and then trying it... thanks for your help and ill post back and let you know

 

[smitbret]

Activate a firewall, whether it is Norton or the built-in Windows XP firewall. Then remove the worm and apply th epatch.
-Brett

 

[wolverinero79]

Always check McAfee

<A HREF="http://vil.nai.com/vil/content/v_100547.htm" target="_new">Click me for removal!</A>

If you don't want to scan that site, here's the best info:

"
Manual Removal Instructions
To remove this virus "by hand", follow these steps:

Apply the MS03-026 patch
Terminate the process msblast.exe
Delete the msblast.exe file from your WINDOWS SYSTEM32 directory (typically c:\windows\system32 or c:\winnt\system32)
Edit the registry
Delete the "windows auto update" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
"

I'm just your average habitual smiler =D