Man this must be a virus, it is spreading like wildfire. I tried to fix the problem but when I did it kept doing this, and mcaffee and norton aren't detecting it.

0

http://www.kaspersky.com/news.html?id=984233 Read this, it might help ya'll understand what this is.

0

http://www.f-secure.com/v-descs/msblast.shtml

0

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en Can the patch fix the problem?

0

Hi, After reading the information on the website above posted by "soz" ive found away to remove the virus... (or so it seems.) I'm using Windows XP Home Edition, Exit the internet and restart machine. 1. CTRL + ALT + DEL and end the "process" MSBLAST.exe 2. Goto the folder C:\WINDOWS\SYSTEM32\ and delete MSBLAST.exe 3. Then goto the folder C:\WINDOWS\Prefetch\ and delete MSBLAST.EXE-09FF84F2.pf 4. Then load up RegEdit. (WINDOWS Folder) and remove (delete) My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows auto update If you cannot find it, goto find and type in windows auto update. 5.Restart machine. And (hopefully) it should be removed.:-) Good Luck, Bye

0

Sorry I forgot to mention, I think after you have removed it. It still comes back through the net. I'm going to stay of the Internet now untill it is sorted.

0

Okay guys, thanks to Gavin Bright, and countless other people which have researched about this annoying error, as well as myself ;). Anyway, to fix this- go to www.microsoft.com, on the left side of the screen there should be a search box, clik on "advanced search" now under the area where it says "search for any of these words" type in "article 823980" (without quotations). Then download the patch for your windows OS. Install it, and restart the computer. Then follow the instructions by Gavin Bright (posted above) and all should be well. With the patch it should not be able to come back, at least it hasn't for me yet. By the way, to buy yourself some time so you can actually do all of this, when the shut down window appears clik start>run>type in "cmd" (no quotations) then in the window that pops up type "shutdown -a" (no quotations). This stops the shutdown but doesn't allow you to copy or paste text and other such things. If this works for everyone else as it has for me, please post it wherever you can, I am sure it will be appreciated.

0

This stupid thing got me too. In addition to the posts by Gavin and Jarrod, Symantec also talks about this worm in detail. http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html There is also line in the windows registry that needs to be removed. Hope this helps!

0

guys go here and download this patch and patch your computer, this will make it so you cant get the virus/worm anymore however you still need to go and delete it like it is said above.

0

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en forgot to post the link

0

Hello all, I'm experiencing a strange twist on the phenominon. I get the same Generic Host Process error leading to automatic shutdown. I've just installed the patch from microsoft however I can find no reference to msblast.exe in the task manager or in the C:\WINDOWS\SYSTEM32\ folder. Is it possble I have this thing lurking on machine under a different name?

0

I also installed the msn patch and did not find the msblast.exe file. But I also downloaded a patch from mcaffee. Question - I followed the directions above using shutdown -a to stop the reboot. How do I fix this back so that I can cut and paste again? Thanks

0

I have a similar problem. I have downloaded the patch but the task manager will not stay open for more than about 3 seconds. And IF i get to the processes tab, (I have to do it a few times to be able to see the whole list) MSBLAST is not there, nor in system32 folder. REGEDIT will not stay open either. Please help me!

0

I just had this problem 2 days now. Symantec has the virus name as Win32.Blast and has specific removal instructions. I try to listen to them but I can't find the virus on my computer even with Norton Antivirus scanning and this problem keeps persistaing, what can I do? I did everything I read in this forum but I can't find MSBLAST.exe in my processes tab nor in my system32 folder. I downloaded the patch and turned off my system restore. But how do I get rid of this virus if I can't find the folders? Please help me, I don't want it to ruin my computer. Also, if I do reformat my computer and backup my data, does the virus save itself onto my backup data? The data I backup is only music, documents, wallpapers and videos. So will it still be on my backup data when I load it back into my computer? Please help me I'm just 16 and not that good with computers.

0

Use gwright@medicave.co.'s technique as explained in response number 4. It has enabled me to use my computer for the first time in 5-6 hours. I downloaded the microsoft patch. Haven't installed it yet. Good luck. Muddy

0

That was very friendly. Just followed your great instructions, hope that’s it gone for good. Luckily Zone Alarm managed to stop the port scanning, which in turn stopped the generic host crashing long enough for me to find this. For those who can't find the files, are you looking at the right letter drive?

0

I only downloaded the patch, I don't look for MSBLAST.exe yet but my computer has been turned on for almost 5 hours now and it's been working fine so far. I have the same question regarding backing the files up. Can I save all my data (pictures, html files, mp3s) without the virus saving itself to my backup?

0

You guys should be able to back up that sort of stuff and re format your drive. It does not seem to be the type of virus that infects random files that would carry it over. As for the above solutions not working and you guys not being able to find MSblast.exe, I really have no clue :( I used to get this error every once in a long while, but a restart would fix it. I'm sorry guys :/.

0

Oops forgot to post this. Lyresa-to enable cut and paste and all other functions again you will need to restart your computer

0

Hello All, I have had this problem i got it yesterday, i have been researching on www.symantec.com and what i have found is that this is a worm it can be deleted very easy. I have just deleted it. Go to www.grisoft.com and download the antivirus scanner install that etc. then run a scan if that doesn't work open AVG control center click update manager then downloading from server free.grisoft.cz then click update now. After is does that it will install automatically run. Run another virus scan, then it will DEFINETELY pick it up. and at the end of the scan it will heal. The way you get this is if you get a major error in your computer and you click send error report, if that happens in future just say No you dont want to report it. Once you do that everything will be fine. By the way the worm contains the following text which is never displayed: I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? stop making money and fix your software!! hehe pretty cool. oh by the way do you not any of that shutdown -a is just wrecks your computer, just do what i said and you should be fine, and maybe do the control alt delete thing and the run REGEDIT and follow their steps they say and to read more about it visit http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html I hope you fix the problem as soon as possible, if anyone tries this please get back to me and tell me if it is successful or if you have any question add me on msn itchygonads7@hotmail.com or throw me a quick email at the same address i will try and get back to you as soon as possible, THANK YOU

0

Hey Mr.Edwards, I was just wondering, so the crashing problem is caused by me sending the error report when they ask me? So in the future wheneever I get that I just click no and I should be fine?

0

Well that is how you got the virus in the first place. But to get rid of it just do what i said above and it will be gone, but yea so in future so you dont get it back just dont send an error report to windows

0

You have to be FAST on the keyboard!!! After a few iterations, I was able to stop this on my Windows XP by following many of the recommendations here. THANK YOU, THANK YOU, THANK YOU. Here are my thoughts: I agree with Ben (above) - do NOT use the "shutdown -a". You can do this much less painfully, and have your cut/paste and everything else working by following some of the other previous instructions. This will require patience and several reboots, but it is worth it! Here's a summary of exactly what process worked for me: 1. Change the actions of the RPC Services as documented so that you can stay up on the internet long enough to get the other info... (as recommended in response 3) Control Panel (use the standard icons) Administration Tools Computer Management Services and Applicatons Services Double-Click on RPC Services Choose "Recovery" Change all three selections to "Take No Action" You may be already caught in a reboot, but it won't reboot next time. 2. Go to www.microsoft.com to download the patch (or in my case, patches). Once you do that, the system should be rebooted again. 3. Finally, follow the EXCELLENT instructions documented by Gavin in Response 11. They worked perfectly for me. Note: I tried Gavin's suggestions before I patched since the info about the patches is farther down in the discussion and I was desperate, and able to cut/paste/print just in time before the system went down. I followed the process three times. Each time, the system was clean after I rebooted, but then the minute I got onto the internet I was dead. The interesting thing was that after the first couple of times, I no longer found the .exe in the Prefetch directory. THis is a bit scary. I did a search - it doesn't seem to be lurking anywhere. I am still very suspicious that this worm is hiding out there, but I'm grateful to be up and running. Now, I'm going to change my RPC settings and see if I stay up. BTW... Geek that I am, I read all of the suggested links (www.kaspersky.com (great!), Symantec (great!), etc). It's amazing what this thing is doing, and I think it's going to be very, very bad for those out there who are not computer-literate. This is why I LOVE UNIX! Also, people are reporting other problems caused by this worm, so be on the lookout for other unknown processes. Good luck!

0

Tennis, so now that i have done my virus scan wiped everything off it, does this mean once i reboot my computer everything will be back again? please get back to me ASAP

0

I was reading more postings and found that the recommendation seems to be removing the offending program BEFORE installing the patch (which is what I did, but since I had to get to the internet to install the patch, everything came back and had to be removed again). I hope I got rid of it! Anyway, just thought I'd add this.

0

This page was of great help 2day, thx for all those tips. i found msblast in msconfig startup too. the only prob i still have is that i lost access to my admin account on XP, can only use guest... dunno if some one as a clue of wut i did wrong

0

Symantec now has a tool to remove the worm: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

0

Hi, I used the Symantec tool to scan for the worm but it didn't detect anything. Generic Host Process for Win32 is still crashing. Can anyone help? Thanks.

0

hey,erm everytime i shutdown or restart msblast comes bak n i cannot copy n paste n i cant view mpgs or avi's, any ideas?

0

when i try and install the patch on microsoft.com it gives me an error saying KB823980 Setup Error,says check if the cryptographic is running,and closes the program. any ideas what i should do? thanks a lot!!!

0

Hi man all that you say it works on me!!! I 've been all day trying to keep away this virus and finnally i do!! 1- Delete the two files (Msblast) like they say in this forum 2- go there http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html and see instructions! With this you will erase WIN32 Blaster worm. 3-do that kjptennis say on response 29 with these you will have more time to download the pacth on www.microsoft.com 4- Donwload the patch on microsoft.com install it and reboot pc!!! You will repair these f---ing problem that have been annoying me all this day!!! Thanx for all who explained it!!!

0

thanks man but the trouble im having is installing the patch i dunno what the heck is the matter but it says KB823980 Setup error Setup could not verify the integrity of the file Update.inf. MAke sure the Cryptographic service is running on this computer. Any ideas??? If you can help I'd really appreciate it!! Thanks!

0

First off many many thanks to Gavin Bright, Jarrod Harrell and the countless others who helped us all get rid of this menace. One question...I downloaded the patch from Microsoft, cleaned out all my temporary files etc. but when it came to deleting MSBLAST.exe from C:\WINDOWS\SYSTEM32 a message popped up saying "acess denied - write protected." No problem deleting MSBLAST.exe from the C:\WINDOWS\Prefetch. If I leave this in there will it come back? I have been on line now for about an hour and about two hours last night after taking all the steps suggested with no problems. Again thanks for all your help.

0

Thanks to Gavin Bright(responce number 11) and Jarrod Harrel(responce number 13).YOU ARE GREAT!!!.My greetings from Greece.

0

Thank you all for your help I was really worried about my computer. But thanks to everyones help I was able to fix my computer YOU GUYS ROCK!!!!!!

0

Thank you all, expecially Gavin Bright and Jarrod Harrell for your help. These threads fixed my problem right up. **Tips for users with the same problem** Be sure to delete MSBLAST.EXE, MSBLAST.EXE-09FF84F2.pf, and the registry key described in thread 11 BEFORE installing the Microsoft Patch. This removes the threat of the virus coming back, and once again, thank you all

0

This resolves the issue!!!!!!! “This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM Time before shutdown: 00:00:59 Message: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly.” To resolve this security flaw with Microsoft Windows XP, follow these steps in order: Step 1: Download the Microsoft security patch. Step 2: Delete the Msblast.exe file and stop the RPC service. Step 3: Install the Microsoft Security patch. Step 4: Restart RPC service. Step 1: Downloading the Microsoft security patch: Download the security patch to a floppy disk using any other system with Internet connection from the following URL: http://tinyurl.com/h84v Step 2: You can “stop” the Remote Procedure Call service from shutting down the system after 60 seconds 1. Click Start --> Run --> and type services.msc. You can also go to the services.msc by following the procedure listed below under “Changing a Services default failure actions.” 2. Select the Remote Procedure Call Service from the list by double clicking it. 3. Select the “Recovery” tab. 4. The default for this service is “Restart the Computer” for all failures. 5. Change each one to “Take No Action.” 6. Select the “Ok” button to apply the settings. Alternatively, you can also stop a computer from automaticly rebooting during the 60 second countdown by doing the following: Click Start --> Run --> and type shutdown -a Step 3: Deleting the Msblast.exe file and stopping RPC service: Caution: The steps below involve registry changes. A registry backup is essential. An incorrect registry entry may cause serious system problems or prevent the computer from starting. For steps to backup the registry, visit the following URL: http://tinyurl.com/jqco After taking a backup, follow these steps: NOTE: Please disconnect from the internet before performing the steps. 1. Start the computer. 2. Press the F8 key repeatedly when the red Compaq logo appears and select Safe mode. 3. When prompted, log in as an Administrator. NOTE: The user name is "administrator" and the password is user specified or blank by default. 4. Click Start and then click Run. 5. In the Open box, type regedit and then click OK. 6. Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7. In the right pane, delete the value: "windows auto update"="msblast.exe" NOTE: If this entry is not found, proceed to next step. 8. Exit the Registry Editor and restart the system in normal mode. Step 4: Installing the Microsoft Security patch: To install the Microsoft Security patch, follow these steps: 1. Insert the floppy disk in the floppy drive. 2. Double-click My Computer. 3. Double-click the Floppy drive. 4. Double-click the "WindowsXP-KB823980-x86-ENU.exe" file. After the installation is complete, remove the floppy disk. 5. Click Start and then click Search. 6. Click All Files and Folders. 7. Type msblast.exe and then click Search. 8. Right-click the msblast.exe file and then click Delete. NOTE: If the file is not found, proceed to next Step. 9. Close all Windows and Restart the system. Step 4: Restarting the RPC service: 1. Click Start --> Run --> and type services.msc. You can also go to the services.msc by following the procedure listed below under “Changing a Services default failure actions.” 2. Select the Remote Procedure Call Service from the list by double clicking it. 3. Select the “Recovery” tab. 4. The default for this service is “Restart the Computer” for all failures. 5. Change each one to “Restart the Service.” 6. Click Apply and O.K. You should no longer get the error message. For more information on the above issue with RPC, please visit the following URLs: www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

0

Visit http://www.pandasoftware.com/about/press/viewNews.aspx?noticia=4038&ver=21&pagina=&numprod=&entorno=for information about the blaster worm. They have a free online virus scan at http://www.pandasoftware.com/activescan/com/activescan_principal.htm .

0

i have tried everything suggested above to fix this problem but nothing has worked. the blast file is not where everyone says it is. in fact 3 different virus scanners couldnt find it. i know i have the virus cause i just recently obtained all the symptoms. i think it may be a variant of the original. can anyone help me

0

also i forget to say when i start my computer it also says C:\windows\system32\2ndsrch.dll is not a valid windows image. would that have anything to do with it?

0

I've got a problem after going through using the symantec tool and microsoft patch.. my colleagues PC has now got no desktop icons or start menu. I can use task manager but can't run explorer. Can't right or left click on the desktop any ideas?

0

I erase the MSBLAST file and when I restart my computer it's again there :-/

0

Hello everybody ! I followed all the steps to get rid of the virus BUT there is still a problem : I cannot install the microsoft patch, the error message is : "Setup cannot update your Windows XP files because the language installed on your system is different from the update language"... Does anyone has the solution... Im in big trouble because, although norton tells me the virus is not here anymore, i still have the consequences (desktop icons unable to be moved, copy-paste functions does not work...) Thanks

0

PLEASE, PLEASE HELP!!! Hey has anyone had trouble turning back on the System Restore after this bug? My comp is clean of the bug, at least I think, I did the microsoft patch and ran symantec...anyway, I turned off the sys. restore like you all said now I can't get it turned back on. The hourglass stays up and I left it on for a whole night, the next morning, it was still there. It's like the system froze!! ???Is there anything I can do to turn the system restore back on? PLEASE HELP!!!

0

Hi all I have the same problems like elfo response 49 I've tried with fix of McAfee and Symantec but nothing Help me please

0

I've restarted many times trying to fix it and now it seems like it's hidden itself from my System32 and Prefetch folders, as I can't find it there - like #45. I can reload McAfee but it had an unrelated problem earlier that I want to avoid. Is there anything else I can do to find it short of overwriting my HD? By the way, the DLL that it lists as effected is CsLsp.dll Thanks, Mike

0

whenever i try to install the patch it says "setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer." what do i do?

0

My XP Home system will still not operate right even after doing all the 'cleansing' above if I turn my RPC back on to Restart. I have run and re-run the Symantec removal tool and it keeps saying it did not find the MSBlast worm anywhere. I also no longer get the error message. How long is it safe to operate the system with the RPC set at 'Take no action'? Another trick to make the follow up patch work is to be 100% up to date with your security patches from MS. I was missing one of the critical ones somehow and my system would not work at all. Once I downloaded and installed it, then the follow up patch works but only with the RPC set as above. Is this thing still on my system but hidden now?

0

When I boot up my computer and press f8 several times (I have a toshiba laptop & windows xp home edition) I am given the option to restore my computer to the latest setting or configuration that worked. See if that works to restore your computer to an earlier state. It worked for me. I did it each time the computer rebooted & while I tried to figure out what to do next. Here's what else I did: The online virus scan at http://pandasoftware.com seemed to have removed the worm from my computer - It told me the number of files that were repaired, although I did not see what the fles were. I then installed the patch (It is found at this link http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en ). I also followed Microsoft's directions to install a firewall. My computer hasn't shut itself down yet and I've been on the internet for several hours. BTW, I was unable to delete the msblast.exe file although I located it and attempted to delete it (it refused to budge) ... I was only able to delete MSBLAST.EXE-09FF84F2.pf . Here's the link to microsoft's firewall instructions: http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/windowsxp/home/using/productdoc/en/hnw_enable_firewall.asp I kept it simple and I did nothing else... So far so good.

0

I updated Norton Anti virus (symantec) this morning and now it recognizes the Blaster worm; but it issues an error message that it is unable to remove it. Years ago I used to use xtgold to change system hidden files. Why can't I delete it? Is it system hidden or is it running in the background? Is there a utility for windows XP that is similar to xtgold to enable me to change the attributes of system hidden files so that I can delete them?

0

i don't know if this is happening to others, but now i can't use windows media player or copy and paste. also i can't view pictures that i have saved. I'm able to get on the internet again but these problems have arisen. has this happened to anyone? and if so how did you fix it?

0

hi everyone and thanks for all the great information!! but im haveing a problem installing the microsoft patch when i attempt to install it it says "KB823980 Setup error Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer." i have no idea how to fix this. can someone please try to help me fix this??? thanks a lot!!!

0

I just figured out the answer to my ownquestion. I should have carefully read answer #11, but since I didn't, I deleted msblast.exe from the safe mode dos prompt after first turning the computer off and on. Because I couldn't delete msblast.exe, I used windows explorer to view the attributes of msblast.exe. It was not read only nor system hidden. I didn't realize that esch time I turned on my computer it loaded itself and was running in the background. I then figured that since msblast.exe was only running when windows was loaded, I turned the computer off and on again, pressed f8 and ran the computer in safe mode with command prompt. Once you get the command prompt, use the following command to delete msblast.exe: 1) cd c:\windows\system32 2) del msblast.exe 3) exit By the way, next time I'll read, not skim, because following the directions in response #11 would have been easier and faster.

0

OK, I've got the PC-Cillin Antivirus update and it detects MSBLAST... my question is, should I just delte it? PC-Cillin says it can't clean it so it gives the option to delete it. Is it that easy? :-/

0

!How to remove Win32:blast in initial state! Msblast runs as system process. You have to run task manager and shut down that process. After that U can delete files in system32 and prefech. Then U must remove registry entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run . Here in M$ can start viruses their action. And of course RPC actions on failiture set to none (no restart or shut down) in Computer Management console / Services and Apps / Services / Remote Procedure Call. To protect U from others attacks from I-net download and install Kerio Personal Firewall (www.kerio.com) - it's free for home use. It's how to remove the virus, but I don't know, what virus had done during its running in computer. It shows, how the microsoft makes the security - send one specific datagram to port 135 (RPC) and open the Hi-Way to PC. Use firewalls or linux :-))

0

Hi everyone, To the person that posted a problem with installing the virus patch - I HAD THE EXACT SAME PROBLEM (and it almost drove me nuts). Whenever I tried to install the patch, an error message was appearing "setup could not verify the integrity of the file update.inf. Make sure the cryptographic service is running on this computer." Here is what finaly worked for me. Click Start, and then click Run. In the Open box, type cmd, and then click OK. At the command prompt, type the following commands, pressing ENTER after each line: net stop cryptsvc ren %systemroot%\system32\catroot2 oldcatroot2 net start cryptsvc ** ON my computer I first entered "net stop cryptsvc" but the other 2 commands came up with an error message of some sort. However, when I tried to install the patch after that it worked.

0

another note to my last message - if that does not work, you may want to just try this. Click Start, and then click Run. In the Open box, type cmd, and then click OK. At the command prompt, type the following command and press ENTER. net stop cryptsvc Then install the patch - and it should work. After you install the patch In the Open box, type cmd, and then click OK. At the command prompt, type the following command and press ENTER. net start cryptsvc

0

Please can someone shed any light for me? I have had all the symptoms of the Blaster including the automatic countdown to restart. I followed some of the advice here by turning off restore and changing the RPC settings to take no action, whilst I tried to sort it out. Today I got a CD with the removal tool from symantec and the patch but...horror of horrors.....the patch will not load as it is telling me that it does not match my pc's 'build' and the removal tool is telling me I don't have the worm! The problem is, what do I do about the vulnerability I have if I can't install the patch? In the meantime, I have reset the RPC settings to 'restart the service' and I haven't been booted out yet....is it still lurking in here? If so, why didn't the removal tool find it....please can someone help?

0