All Windows NT/2K/XP/2003 Users, Very Important Message - Page 3

Q Classic · August 12, 2003, 20:37

oh, don't forget to apply the change after you turn off system restore. system restore needs to be off before the symantec thing can run.

TCO · August 12, 2003, 20:47

Well...why the duck doesn't it say to disable system restore? And why didn't you. Why are computer helpers so damn imprecise.....FGRRRRRRRR!!!!! ARRGGGG
H

TCO · August 12, 2003, 20:48

how the **** do I "turn off system restore"? Jeezus!!

Zopperoni · August 12, 2003, 20:49

Start > Control Panel > System > [tab]System Restore > tick "Turn off System Restore on all drives" > click OK

Koyaanisqatsi · August 12, 2003, 20:53

By the way, if you had turned on the firewall, you could have just gone to the windows update site. I'd turn it off again as soon as you're done, though, because windows built-in firewall sucks.

TCO · August 12, 2003, 21:03

Ok..

1. I turned on the firewall a while ago.

2. I tried running C: saved Symantec in safe mode (F8 mashing and all that) and it SHUTS DOWN the SAME way! DAmn you!

3. When I try to download the windows update, it takes forever and never loads. Plus it tells me to close other programs. Should I close the explorer window then?

4. I got system restore turned off.

Asher · August 12, 2003, 21:14

Quote:

Originally posted by Hueij
Needs to use IE to update Windows? What kind of bullshit is that?

Windows Update uses ActiveX, Mozilla and Opera choose not to implement it, so they choose not to support Windows Update.

TCO · August 12, 2003, 21:17

Ditch the politics man...I need heeeelp. Only reason I am back here at Ply is for you Ashie, baby!

Berzerker · August 12, 2003, 21:22

Asher, I did all what the dl requires and I'm stuck on:

"running processes after install" and "finishing installation"

TCO · August 12, 2003, 21:24

I have not gotten a bootoff in a while. But I think I'm not clean yet.

cinch · August 12, 2003, 21:33

TCO: Like I said, for me, the main things were:

1. Turning system restore off. I understand your frustration; the first advice I got from someone when I had the virus was to try and use system restore to back to an earlier date. That was a bad, bad idea.

2. Making sure you are disconnected from the net while you're doing all this (installing updates, patches; running fixblast.exe).

3. Making sure msblast.exe is ended in the Windows Task Manager (clt alt del) screen.

All that should buy you time and allow you to install updates and run fixblast. Many times.

Also, it doesn't hurt to just plain search for 'msblast.exe' and delete any files that come up.

Don't take my word as gospel, though... I basically just got lucky after taking every single piece of advice I was given; downloading the latest patch and update, and running fixblast, over and over again until now... I think everything is under control.

TCO · August 12, 2003, 21:36

Quote:

Originally posted by cinch
TCO: Like I said, for me, the main things were:

1. Turning system restore off. I understand your frustration; the first advice I got from someone when I had the virus was to try and use system restore to back to an earlier date. That was a bad, bad idea.

2. Making sure you are disconnected from the net while you're doing all this (installing updates, patches; running fixblast.exe).

3. Making sure msblast.exe is ended in the Windows Task Manager (clt alt del) screen.

All that should buy you time and allow you to install updates and run fixblast. Many times.

Also, it doesn't hurt to just plain search for 'msblast.exe' and delete any files that come up.

Don't take my word as gospel, though... I basically just got lucky after taking every single piece of advice I was given; downloading the latest patch and update, and running fixblast, over and over again until now... I think everything is under control.

Cinch:

1. thanks for the understanding.
2. How can I be disconnected from the web while I install patches?
3. I did the ctrl alt del, serarch destroy, and the system resotr uncheck

cinch · August 12, 2003, 21:38

TCO:

Quote:

2. How can I be disconnected from the web while I install patches?

Well, you have to download them while connected, obviously, but you can install them without being connected, once you have them downloaded onto your computer.

Of course, being disconnected may not be that important... All I know is that msblast kept coming back every time I deleted it, until I ran fixblast.exe while disconnected from the net. Since then, everything has been better.

Asher · August 12, 2003, 21:53

To help anyone I'd actually need to look into how exactly this Blast thing works and how the fixes work, and I'm a bit busy for that right now.

Berzerker · August 12, 2003, 22:05

nevermind, installation is complete, thx asher. But that was quite an ordeal - 5 hours to dl and another 1 1/2 to install, etc.

blackice · August 12, 2003, 22:05

Removing autostart entries from the registry prevents the malware from executing during startup.

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
”windows auto update" = MSBLAST.EXE
Close Registry Editor.

Do not forget to clean the reg and make sure you run an online virus scan or just a scan after you cleaned the virus. XP machines and server 03 will have reboot issues if you do not run an antivirus after the cleaning procedure.

Go here for an online scan:

http://housecall.trendmicro.com/

Hit the scan now link.

blackice · August 12, 2003, 22:07

Used the blast fix 40 times today Asher raw but it works well.

Between four stores we fixed 76 machines today, tomorrow will be busier I bet.

TCO · August 12, 2003, 22:14

Do you still hate French people Blacktide?

Gatekeeper · August 13, 2003, 02:37

Hmm ... so is this virus going to launch some sort of massive attack on MS come Saturday from machines that haven't been cleaned?

Gatekeeper

Panag · August 13, 2003, 17:19

Quote:

Originally posted by TCO
1. Ashie. I am on the sysadmin page. Do I have 32bit or 64bit XP. I have XP home. The Washington Post process sends me to that same page.

2. The Washington Post thing is good. But it lies. The msblast is a process not an application. You have to go to applications to kill it.

3. I'm scared to do the Firewall part so I'm blowing that off.

4. I tried (before Washington Post) going to windows update but that doesn 't work. If anything it triggers the shutdown.

hi ,

TCO , go to www.finjan.com , free download , same for www.zonelabs.com , .......

have a nice day