FAQ  Search  Memberlist  Usergroups  Register  Profile  Private messages  Log in

Question about worm removal... Goto page 1, 2, 3  Next

Forum Index -> alt.certification.a-plus

Author	Message
Kathy Guest	Posted: Thu Sep 11, 2003 11:00 pm    Post subject: Question about worm removal... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Kenny Guest	Posted: Thu Sep 11, 2003 11:15 pm    Post subject: Re: Question about worm removal... Follow ALL the instructions here: http://securityresponse1.symantec.com/sarc/sarc.nsf/html/w32.blaster.worm.re moval.tool.html This is an updated version of the FIXBLAST tool. The MS patch has also been updated also, the link for it is on the Symantec link. -- Kenny "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Ghost Guest	Posted: Fri Sep 12, 2003 1:00 am    Post subject: Re: Question about worm removal... In article <vm1ur2c793hla9@corp.supernews.com>, "Kathy" <computermonkeyNOSPAM@inbox.net> wrote: Quote: This is a multi-part message in MIME format. ------=_NextPart_000_0074_01C37899.4F3971C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable A few weeks ago I posted to the NG asking questions about my in-laws = computer having connection problems, well, she called me the other night = and I went over there to see if I could do anything to fix her = computer... well, I unchecked the box that tells the modem to disconnect = after so many minutes. After that I seen she had about ten things in the = systray, so I told her she doesn't need all of these things starting up = at startup. So, I ran the msconfig and went into the Startup folder to = uncheck some things... guess what I found? The msblast.exe (worm)... I = tried my best to download the patch and finally did, but that doesn't = help unless the worm is completely removed. She has NEVER updated any = windows updates or her NAV updates. I tried like hell to update the NAV = files, but each time it tells me there was a problem with the Internet = connection, well, there is no *** problem, unless this could be the = worm preventing me from getting the NAV updates? Anyway, what a mess her = computer is right now and I am the one that has to clean up the mess = just because some people are too *** lazy to get the updates!=20 Now I already know about the FixBlast tool, but I want to remove the = worm manually because I want this to be a learning experience for me. I = know the step by step procedures, but what I really want to know is will = I have to do this in Safe Mode, or is it okay to do it in Normal = Startup? The OS is XP and they don't have broadband connection, just = dial-up... Thanks in advance, Kathy A+ The blaster worm is very easy to get rid of, and yes, as with all viruses/worms, etc- it is best done in safe mode. You may also have more than just the blaster worm in there. It is not at all uncommon to have 4, 5, 6 different viruses infected tons of files. Iin my shop, the record is a single computer, which by the way had the updated McAfee, had 5,220 files infected (yes, over five thousand) with 4 different viruses. That was about a year ago.
Back to top
natural_4u Guest	Posted: Fri Sep 12, 2003 12:30 pm    Post subject: Re: Question about worm removal... Like Ghost said... it's best done in safe mode but not mandatory. Last month I was on a Windows 98 to Windows 2000 upgrade project... and wouldn't you know... in the middle of the project some computers were infected by the blaster worm. I removed them without going into safe mode. They were using a software called OfficeTrend for their anitvirrus. I had to download the Win 2K patch and new virus definitions on a computer that was not infected and burned it onto a CD. From there on I applied it to the infected computers and was doing good. If you have a burner maybe you can do the same... ?!?!?!? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Kathy Guest	Posted: Fri Sep 12, 2003 5:00 pm    Post subject: Re: Question about worm removal... Thank you so much for the responses :-) I figured it may be best to do it in Safe Mode, but I wasn't sure. My son has a cd burner on his computer and I thought about this (burning the updates on a cd), but I put the windows patches on two floppies for now and I am going to try removing the worm later. The other night while I was over there I tried getting the NAV virus definitions and it wouldn't let me... Would it be the worm that was preventing me from getting the new virus definitions? Also, seeing I already put the patch onto the computer would I have to put the patch on again after I remove the worm? And, I should not reboot the computer at all until the worm is removed as it would still be in memory? In my opinion, that little worm is a nasty little sucker! Sorry for all of the questions, but this is my first time removing a worm :-) Kathy A+ "natural_4u" <ask@me.com> wrote in message news:ORi8b.938643$ro6.18714855@news2.calgary.shaw.ca... Like Ghost said... it's best done in safe mode but not mandatory. Last month I was on a Windows 98 to Windows 2000 upgrade project... and wouldn't you know... in the middle of the project some computers were infected by the blaster worm. I removed them without going into safe mode. They were using a software called OfficeTrend for their anitvirrus. I had to download the Win 2K patch and new virus definitions on a computer that was not infected and burned it onto a CD. From there on I applied it to the infected computers and was doing good. If you have a burner maybe you can do the same... ?!?!?!? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Simon Telrenner Guest	Posted: Fri Sep 12, 2003 7:00 pm    Post subject: Re: Question about worm removal... btw, you can download the virus updates to a cd also..... Then you don't have to download anything on the slow machine. -- Kendal R. Emery, MCSE, Network+, A+, MCNGP #19 Systems Administrator Coordinated Home Care kemery@coordinatedhomecare.me.com remove me to email to me "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm3ug64rr2gla6@corp.supernews.com... Thank you so much for the responses :-) I figured it may be best to do it in Safe Mode, but I wasn't sure. My son has a cd burner on his computer and I thought about this (burning the updates on a cd), but I put the windows patches on two floppies for now and I am going to try removing the worm later. The other night while I was over there I tried getting the NAV virus definitions and it wouldn't let me... Would it be the worm that was preventing me from getting the new virus definitions? Also, seeing I already put the patch onto the computer would I have to put the patch on again after I remove the worm? And, I should not reboot the computer at all until the worm is removed as it would still be in memory? In my opinion, that little worm is a nasty little sucker! Sorry for all of the questions, but this is my first time removing a worm :-) Kathy A+ "natural_4u" <ask@me.com> wrote in message news:ORi8b.938643$ro6.18714855@news2.calgary.shaw.ca... Like Ghost said... it's best done in safe mode but not mandatory. Last month I was on a Windows 98 to Windows 2000 upgrade project... and wouldn't you know... in the middle of the project some computers were infected by the blaster worm. I removed them without going into safe mode. They were using a software called OfficeTrend for their anitvirrus. I had to download the Win 2K patch and new virus definitions on a computer that was not infected and burned it onto a CD. From there on I applied it to the infected computers and was doing good. If you have a burner maybe you can do the same... ?!?!?!? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Kathy Guest	Posted: Fri Sep 12, 2003 7:15 pm    Post subject: Re: Question about worm removal... Yes, I was thinking about doing that as well....the faster I can do it, the better, then I am out of there! "Simon Telrenner" <no@way.com> wrote in message news:3f621575@news.zianet.com... Quote: btw, you can download the virus updates to a cd also..... Then you don't have to download anything on the slow machine. -- Kendal R. Emery, MCSE, Network+, A+, MCNGP #19 Systems Administrator Coordinated Home Care kemery@coordinatedhomecare.me.com remove me to email to me
Back to top
Michael Hoffman Guest	Posted: Sat Sep 13, 2003 2:45 am    Post subject: Re: Question about worm removal... Which begs the question .. which AV do you use? I'd assume it's not McAfee "Ghost" <user@user.com> wrote in message news:user-1109032053140001@1.0.0.101... Quote: You may also have more than just the blaster worm in there. It is not at all uncommon to have 4, 5, 6 different viruses infected tons of files. Iin my shop, the record is a single computer, which by the way had the updated McAfee, had 5,220 files infected (yes, over five thousand) with 4 different viruses. That was about a year ago.
Back to top
Ghost Guest	Posted: Sat Sep 13, 2003 3:00 am    Post subject: Re: Question about worm removal... In article <3f6283a4$0$42040$a1866201@newsreader.visi.com>, "Michael Hoffman" <nospam@puleeze.com> wrote: Quote: Which begs the question .. which AV do you use? I'd assume it's not McAfee "Ghost" <user@user.com> wrote in message news:user-1109032053140001@1.0.0.101... You may also have more than just the blaster worm in there. It is not at all uncommon to have 4, 5, 6 different viruses infected tons of files. Iin my shop, the record is a single computer, which by the way had the updated McAfee, had 5,220 files infected (yes, over five thousand) with 4 different viruses. That was about a year ago. We use strictly Norton. It is the only thing I use at home, the only thing I use at the office, the only thing any of my techs use at home, and the only thing we sell or recommend- period. I have seen almost every other anti-virus program out there, and have seen each and everyone of them fail. So far, I have *NEVER* seen NAV fail if it is up to date- with the only possible exception being when a new virus hits, and there is a lag of a few hours from it hitting the world and NAV having the fix/new defs for it available I know, I know, there are people in here who swear they have seen NAV fail, and think McAfee is the best- but then, there are people who think Elvis is still alive too... lol
Back to top
Tom MacIntyre Guest	Posted: Sat Sep 13, 2003 9:15 pm    Post subject: Re: Question about worm removal... On Sat, 13 Sep 2003 02:57:12 GMT, user@user.com (Ghost) wrote: Quote: In article <3f6283a4$0$42040$a1866201@newsreader.visi.com>, "Michael Hoffman" <nospam@puleeze.com> wrote: Which begs the question .. which AV do you use? I'd assume it's not McAfee "Ghost" <user@user.com> wrote in message news:user-1109032053140001@1.0.0.101... You may also have more than just the blaster worm in there. It is not at all uncommon to have 4, 5, 6 different viruses infected tons of files. Iin my shop, the record is a single computer, which by the way had the updated McAfee, had 5,220 files infected (yes, over five thousand) with 4 different viruses. That was about a year ago. We use strictly Norton. It is the only thing I use at home, the only thing I use at the office, the only thing any of my techs use at home, and the only thing we sell or recommend- period. I have seen almost every other anti-virus program out there, and have seen each and everyone of them fail. So far, I have *NEVER* seen NAV fail if it is up to date- with the only possible exception being when a new virus hits, and there is a lag of a few hours from it hitting the world and NAV having the fix/new defs for it available I know, I know, there are people in here who swear they have seen NAV fail, and think McAfee is the best- but then, there are people who think Elvis is still alive too... lol My free AV program (I forget which one it was at the time, InnoculateIT, I think) caught a virus forwarded to me by a Norton user. He said that his sigs were up to date, and he is an electronics technician, so is tech-savvy, but I have no way of knowing if it was. He may have thought that up to date meant once a month, and InnoculateIT typically had about 250 updates a year. Tom
Back to top
lglover Guest	Posted: Sun Sep 14, 2003 2:00 am    Post subject: Re: Question about worm removal... I think Elvis is alive. I saw him when I was in Vegas a couple of months ago. Wait, that was an impersonator. "Ghost" <user@user.com> wrote in message news:user-1209032257120001@1.0.0.101... Quote: In article <3f6283a4$0$42040$a1866201@newsreader.visi.com>, "Michael Hoffman" <nospam@puleeze.com> wrote: Which begs the question .. which AV do you use? I'd assume it's not McAfee "Ghost" <user@user.com> wrote in message news:user-1109032053140001@1.0.0.101... You may also have more than just the blaster worm in there. It is not at all uncommon to have 4, 5, 6 different viruses infected tons of files. Iin my shop, the record is a single computer, which by the way had the updated McAfee, had 5,220 files infected (yes, over five thousand) with 4 different viruses. That was about a year ago. We use strictly Norton. It is the only thing I use at home, the only thing I use at the office, the only thing any of my techs use at home, and the only thing we sell or recommend- period. I have seen almost every other anti-virus program out there, and have seen each and everyone of them fail. So far, I have *NEVER* seen NAV fail if it is up to date- with the only possible exception being when a new virus hits, and there is a lag of a few hours from it hitting the world and NAV having the fix/new defs for it available I know, I know, there are people in here who swear they have seen NAV fail, and think McAfee is the best- but then, there are people who think Elvis is still alive too... lol
Back to top
natural_4u Guest	Posted: Sun Sep 14, 2003 3:00 pm    Post subject: Re: Question about worm removal... "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm3ug64rr2gla6@corp.supernews.com... Thank you so much for the responses :-) I figured it may be best to do it in Safe Mode, but I wasn't sure. My son has a cd burner on his computer and I thought about this (burning the updates on a cd), but I put the windows patches on two floppies for now and I am going to try removing the worm later. The other night while I was over there I tried getting the NAV virus definitions and it wouldn't let me... Would it be the worm that was preventing me from getting the new virus definitions? Quote: Most likely no. Just wondering... how are you trying to obtain the definition updates? Also, seeing I already put the patch onto the computer would I have to put the patch on again after I remove the worm? Quote: No And, I should not reboot the computer at all until the worm is removed as it would still be in memory? Quote: It is recommended to turn OFF the system restore option before you apply any fixes, then turn it back on when the virus is removed. I don't think it would be in memory, but if the system restore was not turned off you should still have infected files in the system restore files. In my opinion, that little worm is a nasty little sucker! Sorry for all of the questions, but this is my first time removing a worm :-) Kathy A+ "natural_4u" <ask@me.com> wrote in message news:ORi8b.938643$ro6.18714855@news2.calgary.shaw.ca... Like Ghost said... it's best done in safe mode but not mandatory. Last month I was on a Windows 98 to Windows 2000 upgrade project... and wouldn't you know... in the middle of the project some computers were infected by the blaster worm. I removed them without going into safe mode. They were using a software called OfficeTrend for their anitvirrus. I had to download the Win 2K patch and new virus definitions on a computer that was not infected and burned it onto a CD. From there on I applied it to the infected computers and was doing good. If you have a burner maybe you can do the same... ?!?!?!? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Kathy Guest	Posted: Sun Sep 14, 2003 7:00 pm    Post subject: Re: Question about worm removal... I was there yesterday... removed the worm exactly the way the instructions said on the Symantec website... did a search and found no more traces of the msblast... after I was feeling pretty good until I got online to download most, I said most because I was not about to get all of the windows updates because they are on dial-up and there were 38 updates for they're computer! They never updated windows updates! Anyway, I gave up on that one because the modem kept timing out and it kept giving me connection errors! Of all the modems in the world, they have a winmodem! I was trying to download the definition updates through the NAV interface... they NEVER updated them... the *** thing still would NOT download them... I tried this about 4 times! I kept getting a connection error... by this time, I was ready to throw the computer out the window!! So to top off everything else I HAD to call HP tech support because my sister-in-law wanted me to... finally, after waiting several minutes for a tech, I get someone on the line... Hmmm, they wanted to walk me through everything I had already done before I called them! Anyway, after going through all of this there is still connection errors and painfully slow page loads, if that, I would mainly get "Cannot display page" errors... it is not the ISP because I have the same ISP and I have no problems at all... does anyone know why it is doing this? I keep thinking the modem, but I don't know... HP told me that it isn't the modem... so here I am feeling like an idiot because I didn't straighten out that person's problem :-( Kathy A - "natural_4u" <ask@me.com> wrote in message news:Hn%8b.950558$ro6.18846171@news2.calgary.shaw.ca... Quote: Most likely no. Just wondering... how are you trying to obtain the definition updates? Also, seeing I already put the patch onto the computer would I have to put the patch on again after I remove the worm? Quote: No And, I should not reboot the computer at all until the worm is removed as it would still be in memory? Quote: It is recommended to turn OFF the system restore option before you apply any fixes, then turn it back on when the virus is removed. I don't think it would be in memory, but if the system restore was not turned off you should still have infected files in the system restore files. In my opinion, that little worm is a nasty little sucker! Sorry for all of the questions, but this is my first time removing a worm :-) Kathy A+ "natural_4u" <ask@me.com> wrote in message news:ORi8b.938643$ro6.18714855@news2.calgary.shaw.ca... Like Ghost said... it's best done in safe mode but not mandatory. Last month I was on a Windows 98 to Windows 2000 upgrade project... and wouldn't you know... in the middle of the project some computers were infected by the blaster worm. I removed them without going into safe mode. They were using a software called OfficeTrend for their anitvirrus. I had to download the Win 2K patch and new virus definitions on a computer that was not infected and burned it onto a CD. From there on I applied it to the infected computers and was doing good. If you have a burner maybe you can do the same... ?!?!?!? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
natural_4u Guest	Posted: Mon Sep 15, 2003 9:30 am    Post subject: Re: Question about worm removal... I think I read something about Norton's AV Live-update will only update every Wednesday. But Viruses comes out every day and Norton does have updates for those new viruses but you will have to download them manually Via the Intelligent Updater. "Tom MacIntyre" <tom__macintyre@hotmail.com> wrote in message news:8t17mvotmb22fsu7ri88dfhvep8ihlue29@4ax.com... Quote: On Sat, 13 Sep 2003 02:57:12 GMT, user@user.com (Ghost) wrote: In article <3f6283a4$0$42040$a1866201@newsreader.visi.com>, "Michael Hoffman" <nospam@puleeze.com> wrote: Which begs the question .. which AV do you use? I'd assume it's not McAfee "Ghost" <user@user.com> wrote in message news:user-1109032053140001@1.0.0.101... You may also have more than just the blaster worm in there. It is not at all uncommon to have 4, 5, 6 different viruses infected tons of files. Iin my shop, the record is a single computer, which by the way had the updated McAfee, had 5,220 files infected (yes, over five thousand) with 4 different viruses. That was about a year ago. We use strictly Norton. It is the only thing I use at home, the only thing I use at the office, the only thing any of my techs use at home, and the only thing we sell or recommend- period. I have seen almost every other anti-virus program out there, and have seen each and everyone of them fail. So far, I have *NEVER* seen NAV fail if it is up to date- with the only possible exception being when a new virus hits, and there is a lag of a few hours from it hitting the world and NAV having the fix/new defs for it available I know, I know, there are people in here who swear they have seen NAV fail, and think McAfee is the best- but then, there are people who think Elvis is still alive too... lol My free AV program (I forget which one it was at the time, InnoculateIT, I think) caught a virus forwarded to me by a Norton user. He said that his sigs were up to date, and he is an electronics technician, so is tech-savvy, but I have no way of knowing if it was. He may have thought that up to date meant once a month, and InnoculateIT typically had about 250 updates a year. Tom
Back to top
natural_4u Guest	Posted: Mon Sep 15, 2003 10:46 am    Post subject: Re: Question about worm removal... You know what... I hardly use the Live-update feature.... go here: http://securityresponse.symantec.com/avcenter/defs.download.html use the Intelligent Updater, it's much better. as for internet connection problem that's a different story... try removing the TCP/IP setting and then re-installing them. What OS is this machine using again? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm9e4s7rb1fo83@corp.supernews.com... I was there yesterday... removed the worm exactly the way the instructions said on the Symantec website... did a search and found no more traces of the msblast... after I was feeling pretty good until I got online to download most, I said most because I was not about to get all of the windows updates because they are on dial-up and there were 38 updates for they're computer! They never updated windows updates! Anyway, I gave up on that one because the modem kept timing out and it kept giving me connection errors! Of all the modems in the world, they have a winmodem! I was trying to download the definition updates through the NAV interface... they NEVER updated them... the *** thing still would NOT download them... I tried this about 4 times! I kept getting a connection error... by this time, I was ready to throw the computer out the window!! So to top off everything else I HAD to call HP tech support because my sister-in-law wanted me to... finally, after waiting several minutes for a tech, I get someone on the line... Hmmm, they wanted to walk me through everything I had already done before I called them! Anyway, after going through all of this there is still connection errors and painfully slow page loads, if that, I would mainly get "Cannot display page" errors... it is not the ISP because I have the same ISP and I have no problems at all... does anyone know why it is doing this? I keep thinking the modem, but I don't know... HP told me that it isn't the modem... so here I am feeling like an idiot because I didn't straighten out that person's problem :-( Kathy A - "natural_4u" <ask@me.com> wrote in message news:Hn%8b.950558$ro6.18846171@news2.calgary.shaw.ca... Quote: Most likely no. Just wondering... how are you trying to obtain the definition updates? Also, seeing I already put the patch onto the computer would I have to put the patch on again after I remove the worm? Quote: No And, I should not reboot the computer at all until the worm is removed as it would still be in memory? Quote: It is recommended to turn OFF the system restore option before you apply any fixes, then turn it back on when the virus is removed. I don't think it would be in memory, but if the system restore was not turned off you should still have infected files in the system restore files. In my opinion, that little worm is a nasty little sucker! Sorry for all of the questions, but this is my first time removing a worm :-) Kathy A+ "natural_4u" <ask@me.com> wrote in message news:ORi8b.938643$ro6.18714855@news2.calgary.shaw.ca... Like Ghost said... it's best done in safe mode but not mandatory. Last month I was on a Windows 98 to Windows 2000 upgrade project... and wouldn't you know... in the middle of the project some computers were infected by the blaster worm. I removed them without going into safe mode. They were using a software called OfficeTrend for their anitvirrus. I had to download the Win 2K patch and new virus definitions on a computer that was not infected and burned it onto a CD. From there on I applied it to the infected computers and was doing good. If you have a burner maybe you can do the same... ?!?!?!? "Kathy" <computermonkeyNOSPAM@inbox.net> wrote in message news:vm1ur2c793hla9@corp.supernews.com... A few weeks ago I posted to the NG asking questions about my in-laws computer having connection problems, well, she called me the other night and I went over there to see if I could do anything to fix her computer... well, I unchecked the box that tells the modem to disconnect after so many minutes. After that I seen she had about ten things in the systray, so I told her she doesn't need all of these things starting up at startup. So, I ran the msconfig and went into the Startup folder to uncheck some things... guess what I found? The msblast.exe (worm)... I tried my best to download the patch and finally did, but that doesn't help unless the worm is completely removed. She has NEVER updated any windows updates or her NAV updates. I tried like hell to update the NAV files, but each time it tells me there was a problem with the Internet connection, well, there is no *** problem, unless this could be the worm preventing me from getting the NAV updates? Anyway, what a mess her computer is right now and I am the one that has to clean up the mess just because some people are too *** lazy to get the updates! Now I already know about the FixBlast tool, but I want to remove the worm manually because I want this to be a learning experience for me. I know the step by step procedures, but what I really want to know is will I have to do this in Safe Mode, or is it okay to do it in Normal Startup? The OS is XP and they don't have broadband connection, just dial-up... Thanks in advance, Kathy A+
Back to top
Display posts from previous: All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 Year Oldest FirstNewest First

	Forum Index -> alt.certification.a-plus	All times are GMT Goto page 1, 2, 3  Next
Page 1 of 3