Question about worm removal...

Kathy · Guest

It is XP, which I am not very familiar with, but I got used to it pretty quick that day and by the end of the day, I pretty much knew my way around...

Would I be able to re-install the TCP/IP setting because it is a HP with everything pre-installed?
"natural_4u" <ask@me.com> wrote in message news:VKf9b.153527$la.3219286@news1.calgary.shaw.ca...
You know what... I hardly use the Live-update feature.... go here: http://securityresponse.symantec.com/avcenter/defs.download.html
use the Intelligent Updater, it's much better.

as for internet connection problem that's a different story... try removing the TCP/IP setting and then re-installing them.

What OS is this machine using again?

ImhoTech · Guest

Intelligent updater is fine for a quick def fix on a new install, or for one as mentioned with network problems, but live update still needs to be run. You can't get all the software updates and bug fixes with just intelligent updater.

"natural_4u" <ask@me.com> wrote in message news:VKf9b.153527$la.3219286@news1.calgary.shaw.ca...
You know what... I hardly use the Live-update feature.... go here: http://securityresponse.symantec.com/avcenter/defs.download.html
use the Intelligent Updater, it's much better.

as for internet connection problem that's a different story... try removing the TCP/IP setting and then re-installing them.

What OS is this machine using again?

ImhoTech · Guest

In XP you actually 'reset' rather re-install as in previous MS OS.

To reset TCP/IP in XP, click Start, then Run type in cmd, push enter. At the command line type:

netsh int ip reset c:\resetlog.txt

Push enter.

That will reset the TCP/IP configuration and save a record of the changes to the resetlog.txt file specified.

Concerning the original issue, considering the time frame that the computer in question went unpatched, I would check for Welchia as well. Welchia will cause the connection symptoms by simply bogging down the connection once on line.

"Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vmbhb79fc6ubee@corp.supernews.com...
It is XP, which I am not very familiar with, but I got used to it pretty quick that day and by the end of the day, I pretty much knew my way around...

Would I be able to re-install the TCP/IP setting because it is a HP with everything pre-installed?
"natural_4u" <ask@me.com> wrote in message news:VKf9b.153527$la.3219286@news1.calgary.shaw.ca...
You know what... I hardly use the Live-update feature.... go here: http://securityresponse.symantec.com/avcenter/defs.download.html
use the Intelligent Updater, it's much better.

as for internet connection problem that's a different story... try removing the TCP/IP setting and then re-installing them.

What OS is this machine using again?

Kathy · Guest

I can't even get that to run. It starts to get the updates and then stops... I did this about 4 times and just got fed up with it... I swear there should be a class to teach users on updating patches and such! If this would have been taken care of before this mess would have never happened!
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmbkcahmj2qde9@corp.supernews.com...
Intelligent updater is fine for a quick def fix on a new install, or for one as mentioned with network problems, but live update still needs to be run. You can't get all the software updates and bug fixes with just intelligent updater.

Kathy · Guest

Thank you so much, ImhoTech! I really appreciate this!

You know, I thought the same thing about the slow connection that there could possibly be another bug in the system... so would I be better off running the FixBlast tool? I have it on a disc because all I did was remove the msblast files manually exactly the way the Symantec website said to.
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmbl2ab3ag3a56@corp.supernews.com...
In XP you actually 'reset' rather re-install as in previous MS OS.

To reset TCP/IP in XP, click Start, then Run type in cmd, push enter. At the command line type:

netsh int ip reset c:\resetlog.txt

Push enter.

That will reset the TCP/IP configuration and save a record of the changes to the resetlog.txt file specified.

Concerning the original issue, considering the time frame that the computer in question went unpatched, I would check for Welchia as well. Welchia will cause the connection symptoms by simply bogging down the connection once on line.

ImhoTech · Guest

I would get the Welchia tool as well.

Its hard to point you in an exact direction considering you have to travel to egt this done, but in a case like this here's what I would do:

First I would make myself a nice juicy cd full of goodies.

Including:

Windows XP Service Pack 1A

http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/default..asp

The rpc exploit patch (the blaster 'fix') Download the XP and the Win2k versions, you can keep this disk handy for future systems.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

The updated rpc patch (to fix the things the first didn't fix) Same here, go ahead and get both the XP and Win2k

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp

The virus removal tools from www.symantec.com . I would also download the tools for Sobig and Dumaru (might as well fill up the cdrom when you burn it) While you're at symantec, also get Rnav2003.exe and Symclean.exe.

Adaware, and the lastest .ref file,

http://download.com.com/3000-2144-10214379.html?tag=lst-0-2 (for adaware)

http://www.lavasoft.de/support/download/ (for the updated defs )

You can get the intelligent updater for the NAV , but note that you HAVE to get Live update working eventually. I use, sell and reccomend NAV, but NAV without Live update is like MS without critical updates. Intelligent updater doesn't include bug fixes and such. Updated definitions that you have downloaded and burned to your cdrom will save a dialup user a chunk of time, the virus definitions are over 4mb.

Although you won't need for this customer, while your making this disk, go ahead and add the Win2k Service pack 4 as well:

http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

Choose the network install rather than express install since you're burning these to cd.

Now when you get there, the first thing you'll want to do is hit ctrl-alt-del and check running processes, look for the typical blaster type file names, msblast.exe, teekids.exe, ***.exe, and also look for DLLHOST.exe , that's welchia, if you see any of those run the appropriate removal tool. Also look for a process called winppr32.exe (that's Sobig, which could have caused the network problems, but would have stopped on the 10). If you don't see any of the files, feel free to ahead and run the Blaster and Welchia fix tools anyway, it will use time, but can't hurt. You don't need to be in safe mode, but you do need to have System Restore turned off.

Next perform just basic system cleanup, and install the Adaware. After installing Adaware, unzip the updated definition file you downloaded and just drop it into c:\program files\Lavasoft\Ad-Aware 6. It simplies replaces the existing file to update the definitions.

Run the Adware, twice.

Run the TCP reset and when done, at the same command line, type sfc /scannow, push enter.

Run the Service pack,

Run the security pacthes, twice each, starting with the oldest. Sounds redundant, but these pacthes have the wondeful habit of failing to install and giving no indication what so ever.

Then test your connection, attempt the live update, if it fails you first need to try a few sites, and a couple downloads (like windows update) to try and find out if its a connection issue, or a live update issue.

More to come...after lunch...

"Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vmbo21adlr967@corp.supernews.com...
Thank you so much, ImhoTech! I really appreciate this!

You know, I thought the same thing about the slow connection that there could possibly be another bug in the system... so would I be better off running the FixBlast tool? I have it on a disc because all I did was remove the msblast files manually exactly the way the Symantec website said to.
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmbl2ab3ag3a56@corp.supernews.com...
In XP you actually 'reset' rather re-install as in previous MS OS.

To reset TCP/IP in XP, click Start, then Run type in cmd, push enter. At the command line type:

netsh int ip reset c:\resetlog.txt

Push enter.

That will reset the TCP/IP configuration and save a record of the changes to the resetlog.txt file specified.

Concerning the original issue, considering the time frame that the computer in question went unpatched, I would check for Welchia as well. Welchia will cause the connection symptoms by simply bogging down the connection once on line.

Kathy · Guest

Wow! Thank you sooo much! I printed out everything so that I don't miss anything... this is a lot of work and sure I hope they appreciate this!
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmbsuf10h9vh4c@corp.supernews.com...
I would get the Welchia tool as well.

Its hard to point you in an exact direction considering you have to travel to egt this done, but in a case like this here's what I would do:

First I would make myself a nice juicy cd full of goodies.

Including:

Windows XP Service Pack 1A

http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/default..asp

The rpc exploit patch (the blaster 'fix') Download the XP and the Win2k versions, you can keep this disk handy for future systems.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

The updated rpc patch (to fix the things the first didn't fix) Same here, go ahead and get both the XP and Win2k

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp

The virus removal tools from www.symantec.com . I would also download the tools for Sobig and Dumaru (might as well fill up the cdrom when you burn it) While you're at symantec, also get Rnav2003.exe and Symclean.exe.

Adaware, and the lastest .ref file,

http://download.com.com/3000-2144-10214379.html?tag=lst-0-2 (for adaware)

http://www.lavasoft.de/support/download/ (for the updated defs )

You can get the intelligent updater for the NAV , but note that you HAVE to get Live update working eventually. I use, sell and reccomend NAV, but NAV without Live update is like MS without critical updates. Intelligent updater doesn't include bug fixes and such. Updated definitions that you have downloaded and burned to your cdrom will save a dialup user a chunk of time, the virus definitions are over 4mb.

Although you won't need for this customer, while your making this disk, go ahead and add the Win2k Service pack 4 as well:

http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

Choose the network install rather than express install since you're burning these to cd.

Now when you get there, the first thing you'll want to do is hit ctrl-alt-del and check running processes, look for the typical blaster type file names, msblast.exe, teekids.exe, ***.exe, and also look for DLLHOST.exe , that's welchia, if you see any of those run the appropriate removal tool. Also look for a process called winppr32.exe (that's Sobig, which could have caused the network problems, but would have stopped on the 10). If you don't see any of the files, feel free to ahead and run the Blaster and Welchia fix tools anyway, it will use time, but can't hurt. You don't need to be in safe mode, but you do need to have System Restore turned off.

Next perform just basic system cleanup, and install the Adaware. After installing Adaware, unzip the updated definition file you downloaded and just drop it into c:\program files\Lavasoft\Ad-Aware 6. It simplies replaces the existing file to update the definitions.

Run the Adware, twice.

Run the TCP reset and when done, at the same command line, type sfc /scannow, push enter.

Run the Service pack,

Run the security pacthes, twice each, starting with the oldest. Sounds redundant, but these pacthes have the wondeful habit of failing to install and giving no indication what so ever.

Then test your connection, attempt the live update, if it fails you first need to try a few sites, and a couple downloads (like windows update) to try and find out if its a connection issue, or a live update issue.

More to come...after lunch...

ImhoTech · Guest

One more bit about live-update, quite often it will fail after an initial install, or if NAV has not been updated since install. If you can get as far as the screnn that would let you select or deselect updates you can probably make it work. You may have to do them one at a time, and not neccesarily in the order that they will be listed.
"Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vmc1m0aap08g37@corp.supernews.com...
Wow! Thank you sooo much! I printed out everything so that I don't miss anything... this is a lot of work and sure I hope they appreciate this!
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmbsuf10h9vh4c@corp.supernews.com...
I would get the Welchia tool as well.

Its hard to point you in an exact direction considering you have to travel to egt this done, but in a case like this here's what I would do:

First I would make myself a nice juicy cd full of goodies.

Including:

Windows XP Service Pack 1A

http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/default..asp

The rpc exploit patch (the blaster 'fix') Download the XP and the Win2k versions, you can keep this disk handy for future systems.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

The updated rpc patch (to fix the things the first didn't fix) Same here, go ahead and get both the XP and Win2k

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp

The virus removal tools from www.symantec.com . I would also download the tools for Sobig and Dumaru (might as well fill up the cdrom when you burn it) While you're at symantec, also get Rnav2003.exe and Symclean.exe.

Adaware, and the lastest .ref file,

http://download.com.com/3000-2144-10214379.html?tag=lst-0-2 (for adaware)

http://www.lavasoft.de/support/download/ (for the updated defs )

You can get the intelligent updater for the NAV , but note that you HAVE to get Live update working eventually. I use, sell and reccomend NAV, but NAV without Live update is like MS without critical updates. Intelligent updater doesn't include bug fixes and such. Updated definitions that you have downloaded and burned to your cdrom will save a dialup user a chunk of time, the virus definitions are over 4mb.

Although you won't need for this customer, while your making this disk, go ahead and add the Win2k Service pack 4 as well:

http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

Choose the network install rather than express install since you're burning these to cd.

Now when you get there, the first thing you'll want to do is hit ctrl-alt-del and check running processes, look for the typical blaster type file names, msblast.exe, teekids.exe, ***.exe, and also look for DLLHOST.exe , that's welchia, if you see any of those run the appropriate removal tool. Also look for a process called winppr32.exe (that's Sobig, which could have caused the network problems, but would have stopped on the 10). If you don't see any of the files, feel free to ahead and run the Blaster and Welchia fix tools anyway, it will use time, but can't hurt. You don't need to be in safe mode, but you do need to have System Restore turned off.

Next perform just basic system cleanup, and install the Adaware. After installing Adaware, unzip the updated definition file you downloaded and just drop it into c:\program files\Lavasoft\Ad-Aware 6. It simplies replaces the existing file to update the definitions.

Run the Adware, twice.

Run the TCP reset and when done, at the same command line, type sfc /scannow, push enter.

Run the Service pack,

Run the security pacthes, twice each, starting with the oldest. Sounds redundant, but these pacthes have the wondeful habit of failing to install and giving no indication what so ever.

Then test your connection, attempt the live update, if it fails you first need to try a few sites, and a couple downloads (like windows update) to try and find out if its a connection issue, or a live update issue.

More to come...after lunch...

Kathy · Guest

Thanks again.... Nope NAV has never been updated since install... This is another thing what had me thinking why it wouldn't update as well... See, I guess my thinking was headed in the right direction :-)
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmc2e57i572sac@corp.supernews.com...
One more bit about live-update, quite often it will fail after an initial install, or if NAV has not been updated since install. If you can get as far as the screnn that would let you select or deselect updates you can probably make it work. You may have to do them one at a time, and not neccesarily in the order that they will be listed.
"Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vmc1m0aap08g37@corp.supernews.com...
Wow! Thank you sooo much! I printed out everything so that I don't miss anything... this is a lot of work and sure I hope they appreciate this!
"ImhoTech" <bobo@yodelers.net> wrote in message news:vmbsuf10h9vh4c@corp.supernews.com...
I would get the Welchia tool as well.

Its hard to point you in an exact direction considering you have to travel to egt this done, but in a case like this here's what I would do:

First I would make myself a nice juicy cd full of goodies.

Including:

Windows XP Service Pack 1A

http://www.microsoft.com/WindowsXP/pro/downloads/servicepacks/sp1/default..asp

The rpc exploit patch (the blaster 'fix') Download the XP and the Win2k versions, you can keep this disk handy for future systems.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

The updated rpc patch (to fix the things the first didn't fix) Same here, go ahead and get both the XP and Win2k

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp

The virus removal tools from www.symantec.com . I would also download the tools for Sobig and Dumaru (might as well fill up the cdrom when you burn it) While you're at symantec, also get Rnav2003.exe and Symclean.exe.

Adaware, and the lastest .ref file,

http://download.com.com/3000-2144-10214379.html?tag=lst-0-2 (for adaware)

http://www.lavasoft.de/support/download/ (for the updated defs )

You can get the intelligent updater for the NAV , but note that you HAVE to get Live update working eventually. I use, sell and reccomend NAV, but NAV without Live update is like MS without critical updates. Intelligent updater doesn't include bug fixes and such. Updated definitions that you have downloaded and burned to your cdrom will save a dialup user a chunk of time, the virus definitions are over 4mb.

Although you won't need for this customer, while your making this disk, go ahead and add the Win2k Service pack 4 as well:

http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

Choose the network install rather than express install since you're burning these to cd.

Now when you get there, the first thing you'll want to do is hit ctrl-alt-del and check running processes, look for the typical blaster type file names, msblast.exe, teekids.exe, ***.exe, and also look for DLLHOST.exe , that's welchia, if you see any of those run the appropriate removal tool. Also look for a process called winppr32.exe (that's Sobig, which could have caused the network problems, but would have stopped on the 10). If you don't see any of the files, feel free to ahead and run the Blaster and Welchia fix tools anyway, it will use time, but can't hurt. You don't need to be in safe mode, but you do need to have System Restore turned off.

Next perform just basic system cleanup, and install the Adaware. After installing Adaware, unzip the updated definition file you downloaded and just drop it into c:\program files\Lavasoft\Ad-Aware 6. It simplies replaces the existing file to update the definitions.

Run the Adware, twice.

Run the TCP reset and when done, at the same command line, type sfc /scannow, push enter.

Run the Service pack,

Run the security pacthes, twice each, starting with the oldest. Sounds redundant, but these pacthes have the wondeful habit of failing to install and giving no indication what so ever.

Then test your connection, attempt the live update, if it fails you first need to try a few sites, and a couple downloads (like windows update) to try and find out if its a connection issue, or a live update issue.

More to come...after lunch...

Ghost · Guest

You think wrong...

I have seen NAV updates every day when the times require it. They update
them as needed for newly discovered threats.

The Live Update on 2002 and above automatically update the defs every time
an internet connection is detected.

In article <Vyf9b.153413$la.3219252@news1.calgary.shaw.ca>, "natural_4u"
<ask@me.com> wrote:

Kathy · Guest

Ghost,

I read the same thing somewhere about NAV too :-)

"Ghost" <user@user.com> wrote in message
news:user-1509031802270001@1.0.0.101...

Kathy · Guest

I don't mean to be an idiot, but I actually hate NAV... every single time I
had it on any of my computers, I had problems til I removed it.... I use a
free AV program and have used it over a year with no problems whatsoever...
I believe it's from http://www.grisoft.com

Sorry thats just my opinion about NAV... Of course others probably never had
the problems I had :-)

"Ghost" <user@user.com> wrote in message
news:user-1209032257120001@1.0.0.101...

jonny bravo · Guest

"Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message
news:vmcet64vqsnf4c@corp.supernews.com...

natural_4u · Guest

I don't think I'm that wrong....

http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2002021908382713

"Ghost" <user@user.com> wrote in message
news:user-1509031802270001@1.0.0.101...

Kathy · Guest

Update on what's going on....

They had to have the system reformatted... When they got the computer back I told them to do ALL of the critical updates before they cruise the Internet... they're response was this "I don't know how to do it"....

Forget it! I am done with people that don't want to bother doing these things... it's in they're hands now, not mine!

Sorry for the rant :-)

Kathy
A+