Re: NT AUTHORITY/SYSTEM/AUTO SHUTDOWN
From: Joana (anonymous_at_discussions.microsoft.com)
Date: 04/26/04
- Next message: puzzled: "Re: cr writing"
- Previous message: Will Denny: "Re: word startup"
- In reply to: Ken Blake, MVP: "Re: NT AUTHORITY/SYSTEM/AUTO SHUTDOWN"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 26 Apr 2004 08:37:57 -0700
that is the solution...?
NO.
It is already infected. If it installs the patch, it is
going to give to him equal. It follows infected. If it
passes a antivirus or it eliminates the virus by hand (it
is thing of children)... it has done well....
I feel it, but by each resumption, somebody (or something,
as the virus to blaster) has entered your machine and
successfully.
You must TO FORMAT. I feel it.
Please, before giving an advice, a little is due to study.
http://www.vsantivirus.com/faq-lovsan.htm#11
http://www.multingles.net/docs/rpc.htm
http://www.multingles.net/docs/razones.htm
http://tinyurl.com/yr6fk
Courtesy of
Jose Manuel Tella Llop
MVP - Windows
jmtella@compuserve.com
http://www.multingles.net/jmt.htm
>-----Original Message-----
>You have the MSBlaster worm. To remove it, do the following:
>
>The following instructions are in three parts
>
>1. Stop it from running
>
>2. Remove it from your system
>
>3. Make sure it doesn't come back
>
>
>
>Before beginning, if you have an always-on internet
connection,
>it's a good idea to disconnect it.
>
>
>
>1. Stop it from running
>
>Press Ctrl-Alt-Delete to bring up the Task Manager, then
on the
>Processes tab, click msblast.exe and then "End process." Reply
>"Yes" to the warning message that comes up.
>
>This stops the worm from running, so your system will not shut
>down. However, it doesn't remove it, and if that's all you
do, it
>will start up again the next time you boot.
>
>
>***
>
>2. Remove it from your system
>
>a. Start the registry editor program, regedit, by going to
Start
>| Run, and typing REGEDIT
>Navigate to
HKEY_Local_Machine\Software\Microsoft\Windows\Current
>Version\Run by clicking the plus signs next to each of the
>folders in the left hand pane. When you get to the last of
them,
>Run, click the word Run itself.
>
>Find an entry called "Windows Auto Update" on the right side.
>Right-click it and delete it.
>
>b. Do a Windows search for msblast, and delete all files
found.
>
>The worm is now gone, and won't start again the next time you
>boot. But if that's all you do, you can get reinfected just as
>you did the first time.
>
>***
>
>
>3. Make sure it doesn't come back
>
>a. Make sure you're running a firewall that prevents worms
like
>this from getting in. You can enable the built-in Windows XP
>firewall, or download and install another one such as the free
>version of ZoneAlarm. To enable the built-in firewall, go to
>Control Panel, double-click Networking and Internet
Connections,
>then click Network Connections. Right-click your
connection, then
>click Properties, and on the Advanced tab, click the option
>"Protect my computer and network..."
>
>
>b. If you've disconnected your internet connection,
reconnect it.
>Download and install the Microsoft patch at
>http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx
>
>That will remove the vulnerability that the worm exploits.
>
>
>c. Be sure you are running an anti-virus program, and that you
>regularly download the latest updated virus definitions.
>
>
>
>--
>Ken Blake - Microsoft MVP Windows: Shell/User
>Please reply to the newsgroup
>
>
>.
>
- Next message: puzzled: "Re: cr writing"
- Previous message: Will Denny: "Re: word startup"
- In reply to: Ken Blake, MVP: "Re: NT AUTHORITY/SYSTEM/AUTO SHUTDOWN"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
