"MSBLAST" IN MY COMPUTER... ...HELP PLEASE

[T O M M Y]

Dear XP experts,

please help me with this worm:

On "August , 30"(today) After being sure I have my firewall on (just XP's),
I connected to the internet via my dial up modem and directly ran my McAfee
to get
the latest version of virus signatures. After downloading the signature and
applying them suddenly the "Generic Host Processor for Win 32" encountered a
problem and closed . Then the dirty Msblast caused my computer to restart ;
The window appeared was the same which was shown on
Microsoft web site and was saying:

" Windows is shutting down. Please save all your work in progress....
..........This shutdown was initiated by NT AUTHORITY\SYSTEM"

Oh God! after logging on after that restart I directly turned the system
restoreoff in all drives, ran my ZoneAlarm (Which was turned off at the
moment of disaster) and connected to internet to make sure I
have the latest updated from MacAfee.Well it was up ot date. Then I
disconnected and ran my Antivirus.....No worm was detected, nothing,
in no drive , nothing.....

And now each time I connect to the internet this message appears by
ZoneAlarm:
"Generic Host Processor for Win 32 wants to connect to internet.
Do want to allow this program access the...." And I choose "no" ofcourse.
.....Then after this the
same message appears again! I again choose "NO"....then it does not do any
thing....

I have problems updating my windows XP, and I am sure my McAfee is up to
date , but can't detect any thing .
Well , What can I do know?...Till now I am writing this no message from the
worm has appeared,(about 45 minutes after the restart)
When will it appear again? And what can I Do? How can I remove it from my
computer? Shall i install XP again and format all drives?


(PS: My XP is installed on D: . My dead 98 is installed on C, but I can not
format the drive C in XP now, because a message says: "Windows can't format
this drive.Be sure it is not in use or no window from it is open.."
Although no window is open and no program uses that drive...I have also
checked Task Manager, but no Msblast.exe process was there..although I saw
some new processes.......Also checking my XP firewall.. it was off!.. I am
sure I didn't turn it off...)

Any Help is Much Regarded

PS.2 : I have ran my MacAfee 6 times from that incident occurred but nothing
yet......

[Nicholas]

Perform a "clean install" of Windows XP, get rid of ZoneAlarm and
install a good, comprehensive security program.

The Windows XP CD is bootable and contains all the tools necessary
to partition and format your drive. Follow this procedure and allow
Windows XP to partition and format your drive:

1. Open your BIOS and set your CD Drive as the first bootable device.
2. Insert your Windows XP CD in the CD Drive and reboot your =
computer.
3. You'll see a message to boot to the CD....follow the instructions.
4. The setup menu will appear and you should elect to delete the =
existing
Windows partitions, then create a new partition(s), then format =
the primary
partition (preferably NTFS) and proceed to install Windows XP.

5. Clean Install Windows XP
http://michaelstevenstech.com/cleanxpinstall.html

[Courtesy of Michael Stevens, MS-MVP]

6. After installing Windows XP, be sure and visit the support website
of the manufacturer of the computer to download and install any
available Windows XP compatible drivers, such as video adapter
and audio drivers.

7. It would be best to physically disconnect all your peripheral =
hardware
devices, except for you mouse and keyboard, before installing XP.
After XP is installed, visit the support website of the =
manufacturer
of each hardware device to obtain the latest drivers or software
designed to work with Windows XP.

Consider purchasing and installing a good,
comprehensive internet security package, such as:

Norton Internet Security 2003
http://www.symantec.com/sabu/nis/nis_pe/

Includes:
.. Norton AntiVirus - protects your PC from viruses
.. Norton Personal Firewall - defends against hackers
.. Norton Privacy Control - keeps your personal information private
.. Norton Intrusion Detection - detects and blocks online security =
breaches
.. Norton Spam Alert - filters unwanted e-mail
.. Norton Parental Control - keeps your children safe on the Internet =
from porn



--=20
Nicholas

------------------------------------------------------------------------

"T O M M Y" > wrote in message:
...

| Dear XP experts,
|=20
| please help me with this worm:
|=20
| On "August , 30"(today) After being sure I have my firewall on (just =
XP's),
| I connected to the internet via my dial up modem and directly ran my =
McAfee
| to get
| the latest version of virus signatures. After downloading the =
signature and
| applying them suddenly the "Generic Host Processor for Win 32" =
encountered a
| problem and closed . Then the dirty Msblast caused my computer to =
restart ;
| The window appeared was the same which was shown on
| Microsoft web site and was saying:
|=20
| " Windows is shutting down. Please save all your work in progress....
| .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
|=20
| Oh God! after logging on after that restart I directly turned the =
system
| restoreoff in all drives, ran my ZoneAlarm (Which was turned off at =
the
| moment of disaster) and connected to internet to make sure I
| have the latest updated from MacAfee.Well it was up ot date. Then I
| disconnected and ran my Antivirus.....No worm was detected, nothing,
| in no drive , nothing.....
|=20
| And now each time I connect to the internet this message appears by
| ZoneAlarm:
| "Generic Host Processor for Win 32 wants to connect to internet.
| Do want to allow this program access the...." And I choose "no" =
ofcourse.
| ....Then after this the
| same message appears again! I again choose "NO"....then it does not =
do any
| thing....
|=20
| I have problems updating my windows XP, and I am sure my McAfee is up =
to
| date , but can't detect any thing .
| Well , What can I do know?...Till now I am writing this no message =
from the
| worm has appeared,(about 45 minutes after the restart)
| When will it appear again? And what can I Do? How can I remove it from =
my
| computer? Shall i install XP again and format all drives?
|=20
|=20
| (PS: My XP is installed on D: . My dead 98 is installed on C, but I =
can not
| format the drive C in XP now, because a message says: "Windows can't =
format
| this drive.Be sure it is not in use or no window from it is open.."
| Although no window is open and no program uses that drive...I have =
also
| checked Task Manager, but no Msblast.exe process was there..although I =
saw
| some new processes.......Also checking my XP firewall.. it was off!.. =
I am
| sure I didn't turn it off...)
|=20
| Any Help is Much Regarded
|=20
| PS.2 : I have ran my MacAfee 6 times from that incident occurred but =
nothing
| yet......
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|=20
|

[Stephen]

Until you patch your system - Windows Update - you are open to infection the
moment you connect to the Internet or an infected network. If you clean your
system but then connect to the 'Net again you are again very likely open to
re-infection. If Windows Update doesn't work thenupdate manually:

http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

Watch the wordwrap on the URL.

Now, that said please do not cross-post. There are a variety of reasons why
you should not cross-post.

This post is posted back to all the groups you entered - because I don't
know if you will be checking them all - but any follow-ups will be sent to
microsoft.public.windowsxp.general only.

Stephen

--

Drop 123 to email me.


"T O M M Y" > wrote in message
...
| Dear XP experts,
|
| please help me with this worm:
|
| On "August , 30"(today) After being sure I have my firewall on (just
XP's),
| I connected to the internet via my dial up modem and directly ran my
McAfee
| to get
| the latest version of virus signatures. After downloading the signature
and
| applying them suddenly the "Generic Host Processor for Win 32" encountered
a
| problem and closed . Then the dirty Msblast caused my computer to restart
;
| The window appeared was the same which was shown on
| Microsoft web site and was saying:
|
| " Windows is shutting down. Please save all your work in progress....
| .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
|
| Oh God! after logging on after that restart I directly turned the system
| restoreoff in all drives, ran my ZoneAlarm (Which was turned off at the
| moment of disaster) and connected to internet to make sure I
| have the latest updated from MacAfee.Well it was up ot date. Then I
| disconnected and ran my Antivirus.....No worm was detected, nothing,
| in no drive , nothing.....
|
| And now each time I connect to the internet this message appears by
| ZoneAlarm:
| "Generic Host Processor for Win 32 wants to connect to internet.
| Do want to allow this program access the...." And I choose "no"
ofcourse.
| ....Then after this the
| same message appears again! I again choose "NO"....then it does not do
any
| thing....
|
| I have problems updating my windows XP, and I am sure my McAfee is up to
| date , but can't detect any thing .
| Well , What can I do know?...Till now I am writing this no message from
the
| worm has appeared,(about 45 minutes after the restart)
| When will it appear again? And what can I Do? How can I remove it from my
| computer? Shall i install XP again and format all drives?
|
|
| (PS: My XP is installed on D: . My dead 98 is installed on C, but I can
not
| format the drive C in XP now, because a message says: "Windows can't
format
| this drive.Be sure it is not in use or no window from it is open.."
| Although no window is open and no program uses that drive...I have also
| checked Task Manager, but no Msblast.exe process was there..although I saw
| some new processes.......Also checking my XP firewall.. it was off!.. I am
| sure I didn't turn it off...)
|
| Any Help is Much Regarded
|
| PS.2 : I have ran my MacAfee 6 times from that incident occurred but
nothing
| yet......
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

[DL]

You might care to check www.symantec.com for info on what files may be
appended/altered. Precise removal info is also available. You could also
initiate an online scan at this site, ensure McAffee is not running when
doing so.
Presumably the McAfee site has similar facilities/info, but I dont use it
so....
Zonealarm should co-exist with XP firewall, so perhaps it should be
configured to start on logon?
Re: dead C, Format frm DOS....?
Format/Reinstall is a last resort
PS some people get upset at cross posting
David

"T O M M Y" > wrote in message
...
> Dear XP experts,
>
> please help me with this worm:
>
> On "August , 30"(today) After being sure I have my firewall on (just
XP's),
> I connected to the internet via my dial up modem and directly ran my
McAfee
> to get
> the latest version of virus signatures. After downloading the signature
and
> applying them suddenly the "Generic Host Processor for Win 32" encountered
a
> problem and closed . Then the dirty Msblast caused my computer to restart
;
> The window appeared was the same which was shown on
> Microsoft web site and was saying:
>
> " Windows is shutting down. Please save all your work in progress....
> .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
>
> Oh God! after logging on after that restart I directly turned the system
> restoreoff in all drives, ran my ZoneAlarm (Which was turned off at the
> moment of disaster) and connected to internet to make sure I
> have the latest updated from MacAfee.Well it was up ot date. Then I
> disconnected and ran my Antivirus.....No worm was detected, nothing,
> in no drive , nothing.....
>
> And now each time I connect to the internet this message appears by
> ZoneAlarm:
> "Generic Host Processor for Win 32 wants to connect to internet.
> Do want to allow this program access the...." And I choose "no"
ofcourse.
> ....Then after this the
> same message appears again! I again choose "NO"....then it does not do
any
> thing....
>
> I have problems updating my windows XP, and I am sure my McAfee is up to
> date , but can't detect any thing .
> Well , What can I do know?...Till now I am writing this no message from
the
> worm has appeared,(about 45 minutes after the restart)
> When will it appear again? And what can I Do? How can I remove it from my
> computer? Shall i install XP again and format all drives?
>
>
> (PS: My XP is installed on D: . My dead 98 is installed on C, but I can
not
> format the drive C in XP now, because a message says: "Windows can't
format
> this drive.Be sure it is not in use or no window from it is open.."
> Although no window is open and no program uses that drive...I have also
> checked Task Manager, but no Msblast.exe process was there..although I saw
> some new processes.......Also checking my XP firewall.. it was off!.. I am
> sure I didn't turn it off...)
>
> Any Help is Much Regarded
>
> PS.2 : I have ran my MacAfee 6 times from that incident occurred but
nothing
> yet......
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

[Frank Saunders MS-MVP, IE/OE]

A script to disinfect:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

MSBlaster lets you remain online long enough to download it.

--
Frank Saunders MS-MVP, IE/OE
Please Reply to Newsgroup
www.fjsmjs.com


"T O M M Y" > wrote in message
...
> Dear XP experts,
>
> please help me with this worm:
>
> On "August , 30"(today) After being sure I have my firewall on (just
XP's),
> I connected to the internet via my dial up modem and directly ran my
McAfee
> to get
> the latest version of virus signatures. After downloading the signature
and
> applying them suddenly the "Generic Host Processor for Win 32" encountered
a
> problem and closed . Then the dirty Msblast caused my computer to restart
;
> The window appeared was the same which was shown on
> Microsoft web site and was saying:
>
> " Windows is shutting down. Please save all your work in progress....
> .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
>
> Oh God! after logging on after that restart I directly turned the system
> restoreoff in all drives, ran my ZoneAlarm (Which was turned off at the
> moment of disaster) and connected to internet to make sure I
> have the latest updated from MacAfee.Well it was up ot date. Then I
> disconnected and ran my Antivirus.....No worm was detected, nothing,
> in no drive , nothing.....
>
> And now each time I connect to the internet this message appears by
> ZoneAlarm:
> "Generic Host Processor for Win 32 wants to connect to internet.
> Do want to allow this program access the...." And I choose "no"
ofcourse.
> ....Then after this the
> same message appears again! I again choose "NO"....then it does not do
any
> thing....
>
> I have problems updating my windows XP, and I am sure my McAfee is up to
> date , but can't detect any thing .
> Well , What can I do know?...Till now I am writing this no message from
the
> worm has appeared,(about 45 minutes after the restart)
> When will it appear again? And what can I Do? How can I remove it from my
> computer? Shall i install XP again and format all drives?
>
>
> (PS: My XP is installed on D: . My dead 98 is installed on C, but I can
not
> format the drive C in XP now, because a message says: "Windows can't
format
> this drive.Be sure it is not in use or no window from it is open.."
> Although no window is open and no program uses that drive...I have also
> checked Task Manager, but no Msblast.exe process was there..although I saw
> some new processes.......Also checking my XP firewall.. it was off!.. I am
> sure I didn't turn it off...)
>
> Any Help is Much Regarded
>
> PS.2 : I have ran my MacAfee 6 times from that incident occurred but
nothing
> yet......
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>