BLASTER REMOVAL

[John C. Harris, MPA]

We never gor the worm in my office due to good firewall and AV protection,
but some of my "field" workers have gotten it on their laptops and are
streaming in panicked. I got it off of all but one of them. On this last one
I got the tool running and it says that it was found and removed, then I
installed the patch, but when starting the system it comes back. I am going
to try running it while in SAFE MODE, as this is the only thing I have not
tried. Has anyone else encountered this and am I on the right track?

Thanks

[Nicholas]

John --

Remove W32.MSBlast.Worm
http://www.dougknox.com/xp/scripts_desc/xp_msblast.htm


--=20
Nicholas

-------------------------------------------------------------------------=
------------------

"John C. Harris, MPA" > wrote in message:
...

| We never gor the worm in my office due to good firewall and AV =
protection,
| but some of my "field" workers have gotten it on their laptops and are
| streaming in panicked. I got it off of all but one of them. On this =
last one
| I got the tool running and it says that it was found and removed, then =
I
| installed the patch, but when starting the system it comes back. I am =
going
| to try running it while in SAFE MODE, as this is the only thing I have =
not
| tried. Has anyone else encountered this and am I on the right track?
|=20
| Thanks
|=20
|

[Larry Samuels MS-MVP XP \(Shell/User\)]

If you are having trouble staying up.
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.

http://www.kellys-korner-xp.com/xp_qr.htm#rpc

There are 2 more variants out now.
The exes for the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone - www.microsoft.com/windowsxp/expertzon
"John C. Harris, MPA" > wrote in message
...
> We never gor the worm in my office due to good firewall and AV protection,
> but some of my "field" workers have gotten it on their laptops and are
> streaming in panicked. I got it off of all but one of them. On this last
one
> I got the tool running and it says that it was found and removed, then I
> installed the patch, but when starting the system it comes back. I am
going
> to try running it while in SAFE MODE, as this is the only thing I have not
> tried. Has anyone else encountered this and am I on the right track?
>
> Thanks
>
>