Announcement Banner
UNSOLVED

tugboat24

updated

23 years ago

T

tugboat24

8 Posts

0

11084

March 23rd, 2004 01:00

Continued Blaster Problems -- Regedit keeps quitting

Hello,

I'm trying to repair my mom's blaster infected computer.  However, in order to remove the infected registry keys I need to run regedit -- but it quits after about 5 seconds. 

Now when I run Adaware and Spybot no remnants of Blaster remain but this regedit problem persists -- which leads me to believe something is still very wrong.

Any ideas?

 

Latitude L933r

384MB Ram

XP HE

 

 

 

  • alevasseur14

    2 Intern

    •

    593 Posts

    432

    0

    Posted March 23rd, 2004 02:00

    Try going to this page and downloading the Blaster removal tool.  I did this to a friend's machine once and it cleaned it right up.

    http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

  • supacool

    33 Posts

    432

    0

    Posted March 23rd, 2004 03:00

    The blaster work disables regedit. Get the tool from MS, and do it that way.
  • alevasseur14

    2 Intern

    •

    593 Posts

    433

    0

    Posted March 23rd, 2004 03:00

    Microsoft or Symantec... they both do the same thing.  I only recommended the Symantec tool because I've used it and know it works.
  • gryjhnhpe

    2 Intern

    •

    1956 Posts

    433

    0

    Posted March 23rd, 2004 06:00

    MS don't have a Virus Removal Tool , they only recommend;

    "If you think there is even the slightest possibility that your computer might be infected, use the free worm removal tool available at your preferred antivirus software vendor's website:"

    Network Associates
    Trend Micro
    Symantec
    Computer Associates

    Be sure to get Microsoft Update to stop Blaster Worm
    http://www.microsoft.com/security/incident/blast.asp

  • tugboat24

    8 Posts

    433

    0

    Posted March 23rd, 2004 16:00

    Thanks to all for your feedback.

    I did download and run fixblast.  It did not find any viruses running nor did it remove any registry keys but it did remove 4 "files" (this tool didnt tell me their names).  Next I moved to MS update to download the patch.  I saved that to my desktop as well and when it extracted and started to install the program quit, I tried again, same thing.  What gives with this worm?  I've looked in the task manager and no variants of the Blaster are actively running.

    What to do next?

     

  • gryjhnhpe

    2 Intern

    •

    1956 Posts

    433

    0

    Posted March 23rd, 2004 19:00

    The MS Patch can only be installed if you have XP SP1 installed.
    To check press Windows+Break(pause) keys together  & under "System" it will show  Service Pack 1 , if installed.
    You should also have a Firewall running before you connect to the Internet , to stop being re-infected with Blaster Worm before you can install MS Patch.
  • JRosenfeld

    2 Intern

    •

    4383 Posts

    433

    0

    Posted March 23rd, 2004 21:00

    I have a USB ADSL modem, (I have to dial in to connect); it shows up as  'internet ADSL' under dial up  in Control panel, Network connections. If you have that or similar, right click on it, click properties, advanced tab, check the box to turn on XP firewall.

    Message Edited by JRosenfeld on 03-23-2004 11:25 PM

  • tugboat24

    8 Posts

    433

    0

    Posted March 23rd, 2004 21:00

    Checked and SP 1 is installed.  Re-ran the tool and it found the blaster again.  Was disconnected from the internet the entire time.  Had already downloaded the patch and again it failed to complete.  This computer is connected to the internet via a USB DSL connect -- it is not on a network adapter -- so I don't know how to firewall with the set up I have.

    Getting really frustrated.  Feedback most welcomed.

  • alevasseur14

    2 Intern

    •

    593 Posts

    433

    0

    Posted March 23rd, 2004 21:00

    Have you turned off System Restore while running the cleaner?  Viruses can hide in there and reinstall themselves on the system after it has been cleaned.
  • tugboat24

    8 Posts

    77

    0

    Posted March 23rd, 2004 22:00

    Yes I have disabled System restore.