Unable to boot Windows XP because of Msblast worm

[knightro]

My home computer has been infected with the msblast worm and it is to the point where I cannot load Windows XP (Professional Edition). When I turn on my computer, it appears to run normally and the just before the windows screen would normally turn on, it "trips" over itself and restarts the booting process. I have tried to boot in safe mode with no luck. It simply will not complete the booting process. To top it off, I do not have my windows xp disk. Any suggestions would be greatly appreciated. I have thousands of files on my hard drive I CANNOT lose.

Thanks-

 

[krysty28]

The same thing happened to me a day ago.
The fix for this worm you can find here:

http://securityresponse.symantec.com/avcenter/FixBlast.exe

this is a fully certified download.
If you don't have time to do this, and the system is restarting try to go as fast as you can to the control panel, administrative tools, services, and go to Remote Procedure Call service, click properties, and in the properties window, at the Recovery tab, set the first failure to restart service, the second take no action and subsequent take no action.
Then run the fix and restart the system. Go to the link suggested by the fix at the end of scanning and download the windows fix for the scv vulnerability.
Run the tool again just to be sure.

 

[knightro]

Thanks for your response Krysty, but my computer will not even finish the boot process in order to start windows. I can erase the worm and fix the damage once I am able to log onto my computer, but the problem is that the computer won't even let me get to that stage. Can't get past the black boot screen. Any suggestions?

 

[emerald]

I have exactly the same problem as knightro and if only I could get into windows it would be a miracle!

I have been trying to find out if it is possible to go in and somehow run a program like f-prot in DOS. But here again the hard drive is formatted in NTFS and a windows 98 boot disk only loads onto FAT and FAT32.

Any ideas from anyone about how to do an uptodate virus scan on an NTFS formatted drive in DOS?

 

[bcastner]

knightro,

You will need to go to another internet connected PC and download the XP boot disks:

http://support.microsoft.com/?kbid=310994

This file will create six floppy disks and allow you into the Recovery Console.

 

[bcastner]

I just tried and the FixBlast.exe mentioned above would certainly fit on a floppy.

Make certain you are not connected to the Internet while trying to repair the machine.

 

[emerald]

knightro

If you haven't resolved your situation yet, this is what I did...

- take out your old hard drive
- replace it with a new drive (connecting to same power cable and IDE cable socket)
- you may need to adjust jumper settings on new drive if neccessary to set as a MASTER drive which you then attach to IDE cable of your computer(assuming it is an IDE drive)
- format the new MASTER drive (NTFS formatting)
- Load windows onto this new drive
- load antivirus program and update antivirus onto windows
- shut down
- make your old hard drive into a SLAVE by adjusting jumper settings for it to act as SLAVE
- attach (SLAVE) to second socket of IDE cable. Older IDE cables only hv one socket - if this is the case, get a new IDE cable and install both drives as explained.
- start computer which will boot into new MASTER drive (C: drive) and SLAVE should show up as a second drive (possibly D: drive)
- scan slave with antivirus and you can back up your data somewhere safe

Get someone competent to help is you are not sure how to do it

Good luck and hope this helps

E.

 

[dietcokebottle]

Access your system via dos and goto \\windows\system32 and delete msblast.exe and problem solved until you patch your machine

 

[bcastner]

This users problem appears more and more like either a damaged registry or the disk volume has reported a large number of errors.

In either case what is required is to boot from the XP CD and hit the first R(epair) choice to enter the Recovery Console.

First step should be a chkdsk /r

The machine should then be booted to see if it will start XP successfully. If XP again refuses to start but simply restarts, a registry rebuild is required. The steps required are very well explained in this article:

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

The behavior of this machine is not symptomatic of msblast infection but of other issues.