blaster virus

[Carl Price]

Some steps have already been taken. Please read carefully.

I have a home-built Intel Pentium II 400 with 512 megs of ram and a 20
gig harddrive. (I have no reason to want to go faster as I live in the country
and cannot get anything but dialup. I don't download much so it serves me.)
I run Windows 2000 with service pack 1 on my primary machine at home and
I have been hit with the blaster virus and I can't seem to get rid of it.

Things I have done:
1. Downloaded (with a machine using Me, Which is not affected) and used
Trend Micro's system cleaner which said it cleaned the virus.

2. System restore to an earlier date.

3. Expanded SVCHOST.EXE from original cd and placed it in the system32 directory
under C:\WINNT.

After all this I still get the message "SVCHOST.EXE HAS CAUSED ERRORS AND WILL BE
SHUT DOWN. AN ERROR LOG WILL BE SAVED." I CAN FIND NO ERROR LOG!

My Questions are:

I have read the stories about people who have reformatted and reinstalled
to no avail. Will this clean the virus from my system? I sure hate to do this
and I will not if it has no effect. If this has no effect what do I do to rid
myself of this thing?

I have downloaded the patch and it will not install. It gives a message that
it must have a minimun of service pack 2 on the machine. Is this true or is it
a message from the virus?

I need some information from someone. Please help

[mrlooneytoon]

have u tried the AV scanner STINGER... u can get it from mcafee.com or symantec.com even trendmicro.com

its a scanner for the msblast.exe virus and a few others... it supposedly scans and deletes the affected files...

if u cant find it at those sites search for it on google. but i'm sure the software name is Stinger

[Redo40]

Hey Carl,
I used Symantec's Removal Tool on a customers machine without any problems, maybe you should try it to be sure all is gone.

Just another thought: Did you disable System Restore before removing the virus?

[Carl Price]

I think I have this all worked out. I downloaded from symantec the blaster fix and ran it. It found another file and deleted it but it did not stop all processes or change the registry. System cleaner from Trend Micro did not find this file but did make some registry changes. I then rebooted and downloaded the patch from Microsoft. I have been using my computer for about an hour now and I have not had any errors that I am aware of. Keep your fingers crossed for me and thanks to everyone who read this and especially everyone who replied.

[mkbert]

I did all the things suggested. Only problem is, I go to MS to download patch and get an error that shuts down IE. On a machine running ME, I get "Send" / "Don't Send" error pop up like you would see on an XP machine.

[mrlooneytoon]

depends on when you tried to access the MS download site for the patch... as of late the virus i heard tries to access the microsoft download site on the computers it has infected therefore overloading the site with traffic... you could try a different date if the virus hasnt got to you yet...

[LawyerRon]

Carl,
Use Symantec's blaster removal tool and be sure you have system retore turned OFF, otherwise it's possible to restore the virus. Boot to safe mode and run the removal tool and you should be OK; I did same for a neighbor and it worked great.

Symantec has a step-by-step procedure that must be followed exactly.

Also, here's a quote from Symantec:

"Note: If, when running the tool, you see a message that the tool was not able to remove one or more files, run the tool in Safe mode. Shut down the computer, turn off the power, and wait 30 seconds. Restart the computer in Safe mode and then run the tool again. All the Windows 32-bit operating systems, except Windows NT, can be restarted in Safe mode. For instructions, read the document "How to start the computer in Safe Mode."