Film-Tech Forum ARCHIVE: Do I have a Virus? (Help Win XP)

This is topic Do I have a Virus? (Help Win XP) in forum Film-Yak at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=002695

Posted by Nate Lehrke (Member # 1460) on 11-15-2003, 04:25 AM:

My question is simple: Do I have a virus and how do I get rid of it!?

I have a: Dell Windows Laptop with XP

Had this problem with a pop-up occuring randomly when connected to the Internet. (The ISP doesn't matter, still happens whether I use MSN or Peoples PC)

The pop-up (below) starts a countdown from 60 seconds before my system is going to be shut down.

So once this pops up, I tryed Control-Alt-Delete, got this screen like normal:

Now, at this point it wont let me end the task or anything, it's hell bent on shutting me down.

Here's the weirdest part. I knew I had this 'issue' so I re-installed Windows XP after deleting the old OS from the drive, so in theory, starting fresh. But neverless, I connect to the internet and it comes right back!

This is a virus, RIGHT? Should I try re-installing XP again? I havent installed ANYTHING besides the OS so I'm not re-installing the virus.

Any help would be appreciated. [Smile]

----------EDIT --------------

I should have waited a couple more minutes to post.
Found it, of course, it's just the MSBLASTER from a while back.

Thanks to anyone that read this and was preparing a response!

FEEL FREE TO DELETE THIS POST [Smile]

Posted by Joe Redifer (Member # 3) on 11-15-2003, 04:50 AM:

Hmmmm.... this just may be the work of the recent "mblast.exe" worm. Maybe a few more people could help me out here. Are you sure that says "mblast.exe" in your photo or did the picture get screwed up since it is digital? I can't be sure. Perhaps you are trying to deceive us? Or maybe you are the devil?

Actually you might want to just follow whatever instructions there are to get rid of the virus (I have no clue) and get a free firewall like Sygate Personal Firewall (free) and an Anti-virus program like Antivir Personal Edition(also free). I have them both and I assure you that they both work great. I do not trust Norton Utilities at all. They used to be great, but they do more harm than good now, but I hear Anti Virus is still OK. Not free though. Steer far away.

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-15-2003, 04:54 AM:

Yes you have the blaster virus.

Download a removal tool from Symantec here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Posted by Michael Schaffer (Member # 1204) on 11-15-2003, 05:57 AM:

How come the virus is still there after a new installation?

Posted by Leo Enticknap (Member # 534) on 11-15-2003, 06:57 AM:

I guess the reinstall, however you did it, didn't totally 'nuke' what was there on the hard disc to start.

Suggestion: back up all data files you want to save first. Then boot the computer direct from a Windows installation CD (use the 'Boot from CD-ROM' option in the BIOS). Delete all the partitions on your hard disc(s), then create a new one and reinstall Windows, using the installation CD setup routine (the one which runs against a blue screen).

I can't see any way you won't have totally nuked the virus by doing that.

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-15-2003, 01:37 PM:

Nate probably just got the virus again since he probably hasn't patched his newly installed operating system, or installed a firewall. The virus won't survive a complete re-install of the OS.

Posted by Jason Burroughs (Member # 68) on 11-15-2003, 03:04 PM:

The MSBlast virus and its variants spread EXTREEMLY quickly. In a test case on an unprotected internet connection the virus infected a newly installed comptuer in under 15 mintues.

Make sure you install ALL the Microsoft Critial updates as they address many security issues that these viruses exploit. However installing just the critial updates will not solve your problem, you also need to get that virus off your comptuer.

Symantec makes a handy free tool that removes this virus and its variants.

Trend and Macaffee also make free tools to remove these viruses as well.

Posted by Bobby Henderson (Member # 840) on 11-15-2003, 07:30 PM:

Viruses will easily survive if one simply reinstalls WindowsXP over an existing installation. Lots of Windows users do this all the time. They figure they'll "clean up" whatever was wrong with their system without having to go through the hassle of reinstalling all their software. My opinion on such procedures: why bother?

The ONLY way to reinstall Windows, IMHO, is to reformat the hard disk and totally nuke whatever data was there and start over truly clean. Any PC built in the last few years can boot directly from the CD-ROM so restoring the OS and software is not anywhere near as difficult as it was 10 years ago.

Any high speed Internet connection will be a big liability when it comes to getting hit with viruses. My guess is some spam-bot out there had Nate's computer info (IP addresses, port numbers, etc.) and automatically put the Blaster worm right back in place.

Posted by Michael Schaffer (Member # 1204) on 11-16-2003, 04:37 AM:

When you erase an installation and format the drive, does that also include the boot sector? Can such a virus survive in that area?

Posted by Gordon McLeod (Member # 33) on 11-16-2003, 01:10 PM:

It is best to cut down all the trees fdisk the drive from a clean bootable floppy

Posted by Bobby Henderson (Member # 840) on 11-16-2003, 09:58 PM:

Some newer PCs feature FDISK on the boot CD-ROM.

Posted by Aldo Baez (Member # 790) on 11-17-2003, 12:04 AM:

The nasty thing about this type of virus is that even if you don't have the physical file on your hard drive, it will STILL shutdown your computer because of the windows RPC exploit.

My friend called me up about his computer shutting down, I though uhh how you have tons of antivirus protection on there which I installed. Turns out his comp was totally clean but the virus was propagating the shutdown command at the isp level. It was easy to fix but I thought it was amazing that the virus was able to do something like this.

Posted by Joshua Lott (Member # 240) on 11-18-2003, 12:08 AM:

A friend of mine is having a problem with what he says is the Msblaster.

I need help on how to fix it.

The computer will start up and go to the windows screen then reboot. It will do that in safe mode as well. He does not have any boot disc's or window's disc's...

any suggestions?

He is running XP home edition, HP Pavilion Xt948.

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-18-2003, 04:38 AM:

The page that I linked to above that tells you how to remove it would probably tell you how to remove it, but that's just a guess. [Smile]

Posted by Don Bruechert (Member # 1538) on 11-18-2003, 10:35 AM:

A virus is always a possibility, but there is another possibility that has not been brought up here, so I will take the opportunity.

There is a function in all versions of windows called windows messenger. This has ABSOLUTELY nothing to do with instant messaging in any way shape or form (this is not about whether you are running windows instant messenger, or any other IM program), it has to do with windows being able to receive broadcast network messages from the system administrator on your network. It is there whether you have a network or not.

For folks that have Windows 95 or 98, you're screwed. For XP, 2000, NT and the rest of the bunch you can shut it off (unless you are in a corporate environment, then check with your local God before doing so). This is one of the flaws in windows that Blaster exploits to do its business.

Have a look at the Microsoft Technet bulletin on how to disable windows messaging and see if it helps you with your problem. As the others stated, you may have the virus too. It never hurts to always make sure your antivirus program is up to date.

Here is the site: Disabling Windows Messaging

----------- Edit to Add....

I subscribe to this newsletter, which I find to be very informative:

WinXPnews

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-18-2003, 10:50 AM:

If you're using non-NT versions of Windows (95, 98, ME) blocking port 135 with your firewall will effectively disable the messenger service for you.

Posted by Joshua Lott (Member # 240) on 11-18-2003, 02:39 PM:

Daryl,

I read through that page and unless I am missing something it does not say how to fix the problem I am looking at.

I turn the computer on and it will go to the screen that has the Windows XP Logo, and it has the little bar on the bottom of the screen then it will give an error message that says ISASS.EXE and complains about a password then it reboots wheather or not you click ok, cancel or the X on the box.

It just does this over and over... It even does this in safe mode.

HELP!

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-18-2003, 02:49 PM:

Sorry, my bad. I read that he said it was "MSBlaster" and must have skipped the rest. [Embarrassed]

Anyway, that doesn't sound like the blaster virus.

Exactly how far does it get to booting operating system? To the blank desktop, the login window, does the taskbar load, do icons appear on the desktop, etc? Is it consistent?

Is the machine disconnected from the network, if one exists? (Actually if it's booting in safe mode without network support it is effectively disconnected -- but yanking the network connection is always a good practice).

Posted by Joshua Lott (Member # 240) on 11-18-2003, 03:11 PM:

Daryl,

It gets to the Windows XP Logo screen, then it gets to a black screen that has the ISASS.EXE error message and then reboots. It does it over and over the same way.

While it was in safe mode it does the same thing, but with safe mode written in the corners. No task bar, log in screen... nothing else.

The machine is a home machine that is not connected in any network.

Posted by Phil Hill (Member # 371) on 11-18-2003, 03:22 PM:

Daryl Said:

quote:
...I read that he said it was "MSBlaster" and must have skipped the rest...

What's with you software writer types? No wonder NO ONE can get a piece of software that works right. Yous never read what was said in the requirements let alone what yous write!

And BTW: Change that "Users Online" to "In Chat"! It is misleading! JEEZE!

(Hugs Daryl) [Razz]

>>> Phil

Posted by Rachel Gilardi (Member # 1016) on 11-18-2003, 03:35 PM:

quote:
What's with you software writer types? No wonder NO ONE can get a piece of software that works right. Yous never read what was said in the requirements let alone what yous write!

Oh, finally SOMEONE says it! [Smile]

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-18-2003, 03:55 PM:

It's probably some variant of the Backdoor.Optix.

Find yourself some disks or a CD and boot into the recovery console. Delete Winstart.bat from the windows directory if it exists. (You should be in the windows directory when you enter recovery console, just type: 'del Winstart.bat')

Also rename (or delete) the file: %windir%\olefiles\Winupdtr.exe.

If you're lucky you'll be able to boot after that. Do some virus scanning to get rid of the registry entries and any remaining files.

See also: Backdoor.Optix.04.c

---

Phil, skimming requirements ensures job security. Although, admittedly, not always your own.

Posted by Joshua Lott (Member # 240) on 11-18-2003, 04:08 PM:

Daryl,

"Find yourself some disks or a CD and boot into the recovery console."

How do i get into the recovery console? I can get into the BIOS set up...

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-18-2003, 04:09 PM:

http://support.microsoft.com/default.aspx?scid=kb;en-us;314058&Product=winxp

BTW, type 'exit' to exit the recovery console when you're done.

Posted by Joshua Lott (Member # 240) on 11-18-2003, 04:30 PM:

Daryl,

Thanks for that info...

I need to create a boot disk for this other computer, but I do not have a floppy drive on my computer. I do have writable cd drive...

How do I create a cd that has the boot stuff so that I can access the recovery console?

Thanks again for your help.

Posted by Daryl C. W. O'Shea (Member # 1303) on 11-18-2003, 04:37 PM:

You pretty much have to have a Windows XP installation disc.

To make floppies (if you don't have a bootable CD-ROM drive -- you'll still need the CD though):

http://support.microsoft.com/default.aspx?scid=kb;EN-US;310994

Choose the appropriate link at the bottom of the page.

Yeah, I know you said you don't have a floppy drive. The links might be useful for somebody in the future though.

For your situation, you're definitely going to need an actual Windows XP installation disc. Most factory bundled OSes / CDs include the recovery console software on their branded CDs.

You can't make a bootable disc with the recovery console software on it by copying files from your computer since the recovery console software isn't copied to your computer.

Posted by Joshua Lott (Member # 240) on 11-18-2003, 04:58 PM:

Thanks Daryl...

I will be trying this tonight or tommorow... I will let you know how it goes.

He does not have any of his discs... but I do have my windows xp install disc.

Posted by Joshua Lott (Member # 240) on 11-28-2003, 07:27 PM:

***Update***

We ended up gaining access to the computer by erasing the small partition, and installing Windows XP Pro on that partition. Now we can access the files. Problem is now we have that operating system and Windows XP Home on the other partition.

Not sure if we screwed it up more or helping it out. [Shrug]