BLASTER VIRUS 60second PC Shutdown

[bluebilly]

I've got the Blaster virus on my Toshiba Protege laptop - but it is not giving me enough time to run the fix to clear it. I've tried starting in safe mode, but the virus still comes up almost straight away. I'm running Windows 2000 Professional. How do I firstly, stop the virus running - as I've said it doesn't give me enough time to access the start/run to enter "shutdown /a" or "shutdown -a" as suggested elsewhere.
Am I looking at a new laptop or is it recoverable ?

Thanks
bluebilly

 

[appi]

Hi,

There's one thing you can do.
In the services you need to change the entries on "Remote Procedure Call".
Click on Prefereces at the RPC.Then the third tab (Restore or so) and change the Entry at all tabs to "restart service". At this the Virus could kill the RPC-deamon but it will be restarted and not the complete server as it is in standard.
That will give you some more time.
hth

 

[bluebilly]

Thanks for your prompt reply - can you provide a step by step guide as to how to access services/RPC ?
Sorry to be so thick !

 

[smah]

Use the Keyword Search function in forum779 to search for blaster. You will find hundreds of helpful instructions.

 

[1101001100110101]

Usually the blaster virus starts as msblast.exe when your pc boots do a ctr+alt+del and run taskmanger. Look for the msblast and kill it. Then you should have enough time to clean your pc up.

 

[bcastner]

Go to your friends computer, or the local library or whatever and download the many blaster fixes available. All would easily fit on a floppy disk:

The new Microsoft removal tool:

http://www.microsoft.com/downloads/...8b-fe98-493f-ad76-bf673a38b4cf&displaylang=en

A lot of alternatives:

http://www.newtechhelp.com/virus/blaster-welchia/

 

[appi]

1.) Click on Settings -> Contoll-Panel -> Administrative Tools -> Services
2.) Double Click on Remote Procedur Call (RPC)
3.) take the tab "Recovery"
4.) Choose e.g. "Take no action"

after eliminating the blaster do not forget to change the values back

 

[bluebilly]

I can't click on Settings/Control Panel etc as the virus doesn't let me get that far - that's the point. As soon as I boot it up, the virus counts down the 60 secs and then shuts it down and restarts the process all before I get to my desktop settings.

 

[1101001100110101]

you can still do ctr+alt+del before the desktop shows and find the task and kill it. I have done it many times on our network when we got infected.

 

[bluebilly]

Alt+Ctrl+Del doesn't bring up Task manager - it just re-starts the PC which is exactly the same as what the virus does.
Any other suggestions ?

Thanks for replying

 

[smah]

Have you done any searching in the xp forum as I suggested? The instructions for xp will apply to Widows 2000 as well.

 

[bluebilly]

Yeah, I've checked it out, but all assume that I'm getting time to run a fix, which I am not and nothing seems to work to stop the virus kicking off.

 

[sulumnad]

What File System do you have? Do you have a boot disk that can take you to C: and do a search for msblast.exe and delete. If you have another computer that has norton AV can you make a disk set/cd to remove the worm by booting up and starting a clean? Or does blaster shut down dos as well? I didn't think so.

 

[ceh4702]

Helps if you use another computer to download the fix save it to a CDROM. Then install it while the Laptop is not on a network, with the Cable pulled out. Network associates also has a utility to clean it off your system called Stinger.

Get Stinger Here:

http://www.nai.com/us/index.asp

Stinger is free.

Stinger will get rid of the Worm, but you can be reinfected if you are attached to a network or the Internet.

If you do not like my post feel free to point out your opinion or my errors.

 

[smah]

Instead of CTRL+Alt+Del try Shift+CTRL+Esc. Then you should be able to end the process that's causing the reboot. Another possiblity that's mentioned in those threads it to open a command prompt and type shutdown -a This will also stop the shutdown process. You can use any appropriate removal tool, including the one provided by MS

http://support.microsoft.com/default.aspx?scid=kb;en-us;826955

 

[paparazi]

Start in safe mode and don't forget to turn of system restore before using the search and restore tool.
Turn restore back on.
Apply microsoft patch once clean.
Fully update Windows and Virus definitions
Turn on Windows XP fire wall.
Martin

Replying helps further our knowledge, without comment leaves us wondering.

 

[rclarke250]

hit F8 as the computer starts to boot windows,this will bring you to a menu where you can choose safe mode. msblast.exe is usually in the c:\windows\system32 directory,delete it...Sometimes the windows directory on 2000 is winnt..so it would be c:\winnt\system32 instead. You should then be able to boot into normal mode.Then follow paparazi's instructions.

 

[bluebilly]

Thank you all for your responses - I've tried everything that you have suggested or rather that which is possible - I am running Windows 2000 not XP, but even in safe mode (using f8) and choosing safe mode with command prompt, the virus still does not give me enough time to enter shutdown -a. The only thing I haven't tried is Shift+CTRL+Esc, which I will try tonight and which will hopefully stop the virus countdown and finally give me enough time to apply the fix.

Thanks again

bluebilly

 

[rclarke250]

if it doesn't then the only way would be to use a boot floppy,or a bootable cd. navigate to the c drive and manually remove the offending files.

 

[ceh4702]

Disable system restore. This is part of the process. Also disconnect from the network. If you are infected probably every PC on your network is infected. The Stinger tool will clean up the PC and get rid of it. However you must disable the System Restore in windows first (If you have that) to get it to work.

If you do not like my post feel free to point out your opinion or my errors.