Msblast Trying To Remove/help!!!

[granogue]

I need to remove MSBLAST from a Compaq Presario 2500 laptop. I tried running the remove tool from Symantec, turned off system restore, and then started the Symantec removal program. A message popped up saying I don’t have administrator rights to remove the worm. How can I remove MSBLAST from the laptop without using the Symantec program, or how can I make myself the administrator temporarily to be able to use the program?

Any help will be appreciated!

[rjfvillarosa]

Boot into safe mode and login as the administrator, then run your scans from safe mode, keep system restore switched off untill you have finished and then switch it back on as soon as you can.

[granogue]

I booted into safe mode as administrator but it isn't showing the symantec tool i need to run to get rid of the worm.

[rjfvillarosa]

Can you not navigate to where ever you saved the tool download?
If the laptop has a floppy, try putting the tool on that it is only small.

[granogue]

no, i don't have floppy drive but i am running norton's virus scanner so hopefully that wiill work

[rjfvillarosa]

Originally Posted by granogue no, i don't have floppy drive but i am running norton's virus scanner so hopefully that wiill work

Is it fully up to date?

[granogue]

probably not. but the msblast worm is an old worm so i figure norton will be able to find it. the last time it was updated was proibably 2 weeks ago

[granogue]

it's scanning right now. i'll let you know if i'm successful. thanks!

[granogue]

My computer has MSBLAST worm. I saw it in task manager, or one of those programs where you can see what processes are running. I downloaded symantec’s MS Blaster. Booted up the computer in safe mode; MS BLASTER didn’t find the worm, but it did delete the value “windows auto update” from the registry key “HKEY\LOCAL MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN”. I think, stupidly in retrospect, well “why not install the security patch from Microsoft?” So I install it in safe mode. Restart computer, the same problem occurs again. I’ll be on the computer for 2,3,4,5 minutes or so and the laptop will suddenly shut down with no warning message. In reading up on msblast on websites they say that one way to know if you have msblast is that before the computer shuts down a dialog box will tell you that the system is shutting down and that this shutdown was initiated by NT AUTHORITY/SYSTEM. However, when my laptop shuts down that dialog box doesn’t appear, it justs shuts off, as if somebody pushed the power button. But I know I have MSBLAST because I saw it in the running processes, or somewhere. The problem now is that I’ve been looking for the place I originally saw msblast and I can’t find it. Might it be possible that because I didn’t successfully delete msblast that maybe it hid itself or gave itself a different name? Should I uninstall the windows patch and run the Symantec tool again? This is really bothersome. I don’t like the way the computer just shuts off. It can’t be that the power adapter is malfunctioning because the laptop battery is fully charged.

I’ve also run Norton and Spybot in safe mode. Norton didn’t find anything. Spybot found 32 adware but I deleted them and I still have the same problem. If I find the msblast file by using windows xp search function, could I manually delete it?

[rcvalencia9]

There is a manual removal of the worm in the symantec site right? You have two options: first, to use the tool. second, to use the manual way... there are a lot of steps to follow so have yourself a printed copy. it include changes in the windows registry. so dont forget to backup

[rjfvillarosa]

I think your best bet now is to boot into safemode with networking, go to www.trendmicro.com and do an online virus scan, the scanner is called house call. Another way is to download AVG7 from www.grisoft.com which is a free antivurus utility and a very good one, you could also try Avast, I am not sure where to get it because I have never used it, it comes highly reccomended here at PC Mech and after install you have to reboot the machine, the program then runs a full virul scan before windows fully starts which is a clever way of beating the viruses because it will delete them before they become active.