fixblast.exe giving errors

[Jürgen Böhm]

Hello,
=

For removing the LOVSAN worm from a XP Home Edition system I followed
the following proceeding:

1. Prepared a CD from an unaffected computer with the MS recommended
patch, the tool FixBlast.exe (from symantec) and the tool chktrust.exe
(also from symantec page) for verifying FixBlast.exe

2. Installed the MS patch and checked the appearance of the appropriate
registry entry.

3. Copied the two other files to a folder on partition D:\

4. Verified successfully with chktrust the integrity of FixBlast.exe

5. Switched off system restore

6. Ran FixBlast.exe

Now a problem appeared: Seemingly FixBlast.exe removed the worm file
msblast.exe and the registry entry belonging to the worm. But when
scanning through the files on the harddisk (as indicated by one filename
after the other being displayed in its window) it aways came to a halt
at

C:\WINDOWS\I386\MSN40.MA_

and wanted to report an error to Microsoft, which I allowed it to do.
After reporting the error, the tool terminated.

I also tried to do step 6. with SAFEBOOT mode, but it didn't help.

After step 6 I reenabled system restore.

Now my questions:

A) Does anybody has an explanation for this behaviour, or noticed
something similar himself ? =


B) Why is FixBlast.exe scanning the files anyway ? By what symantec
says, the worm does not alter files on harddisk.

C) Can the system be trusted now, or should it be completely reinstalled
?

D) Can the problem be solved, so that FixBlast.exe runs through as
intended ?

Greetings

J=FCrgen

-------------------------------------------------------------------------=

Dipl.-Math. J=FCrgen B=F6hm =

"At a time when so many scholars in the world are calculating, is it not
desirable that some, who can, dream ?" R. Thom