Scarecrow Man Posted July 6, 2004 Report Share Posted July 6, 2004 I don't know what to do. Any ideas?I've fixed it many times before, but I can't remember. Quote Link to comment Share on other sites More sharing options...
-pops- Posted July 6, 2004 Report Share Posted July 6, 2004 You have the blaster worm - or one of its relations. Do a search here and you will find loads of posts, including how to get rid of it. Quote Link to comment Share on other sites More sharing options...
nellie2 Posted July 6, 2004 Report Share Posted July 6, 2004 Stinger is good for this!Or an on line virus scan! here You do need to turn off system restore though and you will lose your restore points, but the virus likes to sit in system restore and that is the only way to get at it! :( Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted July 6, 2004 Author Report Share Posted July 6, 2004 Yes, I've heard of this being caused by Blaster. BUTI'll give you a few scenarios of when I get the error.1. WINXP after upgrading from 982. WINXP fresh install (on new computer)3. WIN2K after upgrading from 98I've seen this error many times, I can stop it from shutting down, go to run and type 'shutdown -a'. but this does not fix the problem.Also, setting the RPC to restart service, instead of computer seems to be a popular fix as well.I will scan for Blaster, but if it's not there, what else could it be? (I have a feeling it won't be) Quote Link to comment Share on other sites More sharing options...
-pops- Posted July 6, 2004 Report Share Posted July 6, 2004 The blaster worm installs itself on any XP computer that doesn't have the MS blaster worm patch. It does this almost immediately you connect to the Internet. Before connecting to the next with a re- or frsh install you should have already installed the blaster worm patch. Look here http://www.microsoft.com/security/incident/blast.mspxWhether or not your scan shows the worm there, you ought to install the patch to protect you from future infections. Quote Link to comment Share on other sites More sharing options...
Redhat Posted July 6, 2004 Report Share Posted July 6, 2004 Running a Personal Firewall before connecting to the internet will prevent blaster infection also. My Rule : NEVER connect XP to the internet without running a personal firewall and then instantly update the system with all patches from WindowsUpdate. Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted July 6, 2004 Author Report Share Posted July 6, 2004 OK, fair enough, but what about this.The most recent one that has the error is the WIN2K.Now, after installing from windows 98 (could have been previously infected?) I have not been able to log in, let alone get on the internet! There was an admin password, and the owner couldn't remember the user names upgraded from win98.I've fixed the user problem, but this error is still buggin me.I'm going to try patching, looking for blaster, and install a firewall on all computers that are getting the error.Thanks for input, I'll let you know how it goes.P.S. no msblast.exe running in processes on ANY of the machines. Quote Link to comment Share on other sites More sharing options...
-pops- Posted July 6, 2004 Report Share Posted July 6, 2004 The most recent one that has the error is the WIN2K.According to the reference I gave above, blaster will affect W2K systems as well. Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted July 7, 2004 Author Report Share Posted July 7, 2004 Alright. WIN2K system had a filed called 'mslaugh.exe' blaster virus.Only thing is, after doing the removal tool, every time I connect to the internet (cable modem so basically when I turn it on) I get the error again.one note is, the error doesn't come up when not connected, and does not come up in safe mode.it does come up, however, in safe mode with networking, and connected to the internet.When the error comes up, it's process is winlogon.exe, which, from what I've noticed is the equivilent to explorer.exe from previous versions of windows.Also, the blaster virus displays RPC call failure, whereas the error I am getting (both win2k and xp systems) the error is with lsass.exe.Any ideas on the new info? Quote Link to comment Share on other sites More sharing options...
-pops- Posted July 7, 2004 Report Share Posted July 7, 2004 lsass.exe is the sasser worm.You say you're using the blaster remover tool but that is not enough on its own. You must also apply the MS patch which you can get via the reference I gave above.Forgive me if I'm wrong in this but I'm getting the impression there is something of a wind up going on here. If not that, then a case of extreme lassitude. All the information that is being offered to answer this query can easily be obtained from a quick Google - that is certainly where I'm getting it from. In the unlikely event that you are unaware of Google it can be found and downloaded here Quote Link to comment Share on other sites More sharing options...
Redhat Posted July 7, 2004 Report Share Posted July 7, 2004 Forgive me if I'm wrong in this but I'm getting the impression there is something of a wind up going on hereAnd i've already said, install firewall before connecting, but seems our advice falling on deaf ears? :( Scarecrow - what's gowin on matey? :huh: :P Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted July 7, 2004 Author Report Share Posted July 7, 2004 Sorry guys, I've been fighting with this problem for weeks now, and am getting fed up.I have taken everyones answers into consideration and I am going to do everything suggested here. I thank you all! I couldn't have gotten this far without you.I'm dealing with this problem on multiple machines as well, and it gets you frustrated when you can't fix it.. trust me. Quote Link to comment Share on other sites More sharing options...
-pops- Posted July 7, 2004 Report Share Posted July 7, 2004 Cardinal rule I use nowadays when I install Windows, especially on new machines, is immediately I have installed the operating system, install the blaster patches and suchlike. Then I install a good A/V* and firewall. Only after that do I even think about connecting to the internet to install Spywareblaster, Spybot S&D and Adaware.Only then do I even think about installing anything else.*The A/V is an up to date one downloaded fresh from another machine. Quote Link to comment Share on other sites More sharing options...
Redhat Posted July 7, 2004 Report Share Posted July 7, 2004 Don't worry, i've done it umpteen times before - it's quite monotonous ;) Quote Link to comment Share on other sites More sharing options...
Redhat Posted July 7, 2004 Report Share Posted July 7, 2004 For an EXCELLENT step-by-step guide to securing a new installation of 2000/XP see a friend of mine's site : http://www.markusjansson.net/exp.html :) Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted July 7, 2004 Author Report Share Posted July 7, 2004 VERY thurough Redhat! Thanks.I do know how to "properly" set up windows so these types of things don't happen.. The only problem is, when I do a housecall, usually the computer is in such a bad state it's hard to work with.The win2k was my fault though. What can I say, cable modem. I am used to dial up, so it takes me 15 minutes to get the virus even if I am connected :D I think I have the means now to fix it, and I appreciate everyones time.I'll let you know how it goes later on. :) Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted July 8, 2004 Author Report Share Posted July 8, 2004 Well, I got it. The reason I was having so much trouble was because any CD I burned for the computer (updates, patches, antivirus, firewall) DIDNT WORK!So, I managed to get on the net, and download zone alarm just before the computer restarted.I am now sailing free, and patching windows as we speak :D Thanks for everyones help. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.