Blaster Worm - unable to start windows

[Simon S]

We think that my friend has the Blaster Worm virus but he
is unable to start windows for enough time to add the MS
patch or run the Symantec Remove tool. As soon as Windows
starts up he gets a messages saying that he is shutting
down.

Any advice would be greatly appreciated.

Many thanks
Simon

[Andy Allred [MS]]

Simon,
When Windows starts Click on Start | Run then enter "cmd", no quotes. Then
in the command window type "shutdown -a" without the quotes, hit Enter. This
should prevent the worm from shutting down the system.

Now follow the steps listed here to clean your system and remove the worm:
What you should know: http://www.microsoft.com/security/incident/blast.asp

Good luck.
Andy
--

This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ========


"Simon S" > wrote in message
...
> We think that my friend has the Blaster Worm virus but he
> is unable to start windows for enough time to add the MS
> patch or run the Symantec Remove tool. As soon as Windows
> starts up he gets a messages saying that he is shutting
> down.
>
> Any advice would be greatly appreciated.
>
> Many thanks
> Simon
>

[Larry Samuels MS-MVP XP \(Shell/User\)]

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.

Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal

tool.
Run the tool to remove the worm,then follow the onscreen prompts to download

the patch.


There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.
As more variants are found Kelly and Doug are adding removal instructions to
the

script to kill them as well.



--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone - www.microsoft.com/windowsxp/expertzone



"Simon S" > wrote in message
...
> We think that my friend has the Blaster Worm virus but he
> is unable to start windows for enough time to add the MS
> patch or run the Symantec Remove tool. As soon as Windows
> starts up he gets a messages saying that he is shutting
> down.
>
> Any advice would be greatly appreciated.
>
> Many thanks
> Simon
>