No internet access and unable to access RPC properties with BLASTER Wo

[lkarock]

Trying to fix/help others fix Blaster Worm. Must download files to fix virus.

Following steps from Microsoft to stop computer from rebooting TRIED:

click start, run, type services.msc
Locate remote procedure call, double click, click recovery and change restart computer options to 30 minutes before restart.(WORKS 80%)
Problem: sometimes Extended tab is blank or blue and Standard tab list services but I cannot access properties.
Please explain the difference and a fix.

Prior to call customer can access internet but gets the blaster shutdown error.

Tried MS suggestion to create firewall on internet connection, however there are either NO connections in network connections, or they are disabled. Re connecting the connection used to access isp will dial but fail to connect, or connect but not allow browzeing.


HELP NEED TO DOWNLOAD PATCH AND REMOVAL TOOLS

ie: icf firewall on internet connection. Shows all connections disabled, reconnecting

 

[Marcs41]

If the users looses the connection, it is that the PC is infected, so that is 'normal'
Have them do these steps first
Terminating the Malware Program

This procedure terminates the running malware process from memory.

Open Windows Task Manager, press
CTRL+SHIFT+ESC, and click the Processes tab.
In the list of running programs, locate the process:
MSBLAST.EXE

Select the malware process, then press the End Process button.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup.

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
"windows auto update" = MSBLAST.EXE
Close Registry Editor.


For the rest, check the links

http://www.microsoft.com/security/incident/blast.asp

and

http://www.microsoft.com/security/incident/blast_faq.asp

If you skip 1 step, or do not update, the virus will come back.
Update any antivirus FIRST! Other variants exist and you will result in the same situation soon enough.

Also keep in mind that 2000 and/or XP may restrict users to change some settings, in which case they would need admin rights to fix it!

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}

 

[bcastner]

First, Ctrl-Alt-Del to bring up the task manager. You should see the process blaster.exe or msblast.exe running. Highligh the task an click "End process"

If the RPC shutdown message appears immediately click the Start Button, Run, and type
shutdown -a

and hit enter.

This will cancel the pending shutdown and let your download proceed.