Re: "MSBLAST" IN MY COMPUTER... ...HELP PLEASE (2)

[T O M M Y]

following my first message :

Dear XP experts :


I recently visited http://www.kellys-korner-xp.com/xp_qr.htm#rpc
Then I followed the instruction....set the new setting for "Remote
Procedure Call (RPC)/Recovery/First Failure/Restart the crevice...Then
downloaded the script , it found no Msblast in windows registry. Then I
downloaded the patch, it did not open because of a trouble.

Can this be a new kind of Msblast? As I mentioned , my MacAfee did not find
any thing
and there was no msblast.exe in Task Manager.

Please help....

"T O M M Y" > wrote in message
...
> Dear XP experts,
>
> please help me with this worm:
>
> On "August , 30"(today) After being sure I have my firewall on (just
XP's),
> I connected to the internet via my dial up modem and directly ran my
McAfee
> to get
> the latest version of virus signatures. After downloading the signature
and
> applying them suddenly the "Generic Host Processor for Win 32" encountered
a
> problem and closed . Then the dirty Msblast caused my computer to restart
;
> The window appeared was the same which was shown on
> Microsoft web site and was saying:
>
> " Windows is shutting down. Please save all your work in progress....
> .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
>
> Oh God! after logging on after that restart I directly turned the system
> restoreoff in all drives, ran my ZoneAlarm (Which was turned off at the
> moment of disaster) and connected to internet to make sure I
> have the latest updated from MacAfee.Well it was up ot date. Then I
> disconnected and ran my Antivirus.....No worm was detected, nothing,
> in no drive , nothing.....
>
> And now each time I connect to the internet this message appears by
> ZoneAlarm:
> "Generic Host Processor for Win 32 wants to connect to internet.
> Do want to allow this program access the...." And I choose "no"
ofcourse.
> ....Then after this the
> same message appears again! I again choose "NO"....then it does not do
any
> thing....
>
> I have problems updating my windows XP, and I am sure my McAfee is up to
> date , but can't detect any thing .
> Well , What can I do know?...Till now I am writing this no message from
the
> worm has appeared,(about 45 minutes after the restart)
> When will it appear again? And what can I Do? How can I remove it from my
> computer? Shall i install XP again and format all drives?
>
>
> (PS: My XP is installed on D: . My dead 98 is installed on C, but I can
not
> format the drive C in XP now, because a message says: "Windows can't
format
> this drive.Be sure it is not in use or no window from it is open.."
> Although no window is open and no program uses that drive...I have also
> checked Task Manager, but no Msblast.exe process was there..although I saw
> some new processes.......Also checking my XP firewall.. it was off!.. I am
> sure I didn't turn it off...)
>
> Any Help is Much Regarded
>
> PS.2 : I have ran my MacAfee 6 times from that incident occurred but
nothing
> yet......
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

[John Shelton]

The script does not try to detect the virus, it only changes the registry
that the virus changed. You are still required to update the RPC
protection. I have taken care of the problem on many PC's and especially
ones that have McAfee. McAfee is my biggest source of income because it
sucks big time. It has missed soooo many viruses.
Go to http://www.symantec.com/avcenter/ and look for the removal tools.
Follow the directions especially the part of booting in safe mode to do the
scan. If you still can't stay online due to timing out then Start>Run and
type "shutdown -a" without quotes.

John Shelton
"T O M M Y" > wrote in message
...
> following my first message :
>
> Dear XP experts :
>
>
> I recently visited http://www.kellys-korner-xp.com/xp_qr.htm#rpc
> Then I followed the instruction....set the new setting for "Remote
> Procedure Call (RPC)/Recovery/First Failure/Restart the crevice...Then
> downloaded the script , it found no Msblast in windows registry. Then I
> downloaded the patch, it did not open because of a trouble.
>
> Can this be a new kind of Msblast? As I mentioned , my MacAfee did not
find
> any thing
> and there was no msblast.exe in Task Manager.
>
> Please help....
>
> "T O M M Y" > wrote in message
> ...
> > Dear XP experts,
> >
> > please help me with this worm:
> >
> > On "August , 30"(today) After being sure I have my firewall on (just
> XP's),
> > I connected to the internet via my dial up modem and directly ran my
> McAfee
> > to get
> > the latest version of virus signatures. After downloading the signature
> and
> > applying them suddenly the "Generic Host Processor for Win 32"
encountered
> a
> > problem and closed . Then the dirty Msblast caused my computer to
restart
> ;
> > The window appeared was the same which was shown on
> > Microsoft web site and was saying:
> >
> > " Windows is shutting down. Please save all your work in progress....
> > .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
> >
> > Oh God! after logging on after that restart I directly turned the
system
> > restoreoff in all drives, ran my ZoneAlarm (Which was turned off at the
> > moment of disaster) and connected to internet to make sure I
> > have the latest updated from MacAfee.Well it was up ot date. Then I
> > disconnected and ran my Antivirus.....No worm was detected, nothing,
> > in no drive , nothing.....
> >
> > And now each time I connect to the internet this message appears by
> > ZoneAlarm:
> > "Generic Host Processor for Win 32 wants to connect to internet.
> > Do want to allow this program access the...." And I choose "no"
> ofcourse.
> > ....Then after this the
> > same message appears again! I again choose "NO"....then it does not do
> any
> > thing....
> >
> > I have problems updating my windows XP, and I am sure my McAfee is up to
> > date , but can't detect any thing .
> > Well , What can I do know?...Till now I am writing this no message from
> the
> > worm has appeared,(about 45 minutes after the restart)
> > When will it appear again? And what can I Do? How can I remove it from
my
> > computer? Shall i install XP again and format all drives?
> >
> >
> > (PS: My XP is installed on D: . My dead 98 is installed on C, but I can
> not
> > format the drive C in XP now, because a message says: "Windows can't
> format
> > this drive.Be sure it is not in use or no window from it is open.."
> > Although no window is open and no program uses that drive...I have also
> > checked Task Manager, but no Msblast.exe process was there..although I
saw
> > some new processes.......Also checking my XP firewall.. it was off!.. I
am
> > sure I didn't turn it off...)
> >
> > Any Help is Much Regarded
> >
> > PS.2 : I have ran my MacAfee 6 times from that incident occurred but
> nothing
> > yet......
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
>
>

[Jupiter Jones [MVP]]

Tommy;
Did you install the patch?
Without the patch and if you have an issue with your firewall, your
chances of getting Blaster any variety go way up:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://dts-l.org/index.html


"T O M M Y" > wrote in message
...
> following my first message :
>
> Dear XP experts :
>
>
> I recently visited http://www.kellys-korner-xp.com/xp_qr.htm#rpc
> Then I followed the instruction....set the new setting for "Remote
> Procedure Call (RPC)/Recovery/First Failure/Restart the
crevice...Then
> downloaded the script , it found no Msblast in windows registry.
Then I
> downloaded the patch, it did not open because of a trouble.
>
> Can this be a new kind of Msblast? As I mentioned , my MacAfee did
not find
> any thing
> and there was no msblast.exe in Task Manager.
>
> Please help....
>
> "T O M M Y" > wrote in message
> ...
> > Dear XP experts,
> >
> > please help me with this worm:
> >
> > On "August , 30"(today) After being sure I have my firewall on
(just
> XP's),
> > I connected to the internet via my dial up modem and directly ran
my
> McAfee
> > to get
> > the latest version of virus signatures. After downloading the
signature
> and
> > applying them suddenly the "Generic Host Processor for Win 32"
encountered
> a
> > problem and closed . Then the dirty Msblast caused my computer to
restart
> ;
> > The window appeared was the same which was shown on
> > Microsoft web site and was saying:
> >
> > " Windows is shutting down. Please save all your work in
progress....
> > .........This shutdown was initiated by NT AUTHORITY\SYSTEM"
> >
> > Oh God! after logging on after that restart I directly turned the
system
> > restoreoff in all drives, ran my ZoneAlarm (Which was turned off
at the
> > moment of disaster) and connected to internet to make sure I
> > have the latest updated from MacAfee.Well it was up ot date. Then
I
> > disconnected and ran my Antivirus.....No worm was detected,
nothing,
> > in no drive , nothing.....
> >
> > And now each time I connect to the internet this message appears
by
> > ZoneAlarm:
> > "Generic Host Processor for Win 32 wants to connect to internet.
> > Do want to allow this program access the...." And I choose "no"
> ofcourse.
> > ....Then after this the
> > same message appears again! I again choose "NO"....then it does
not do
> any
> > thing....
> >
> > I have problems updating my windows XP, and I am sure my McAfee is
up to
> > date , but can't detect any thing .
> > Well , What can I do know?...Till now I am writing this no message
from
> the
> > worm has appeared,(about 45 minutes after the restart)
> > When will it appear again? And what can I Do? How can I remove it
from my
> > computer? Shall i install XP again and format all drives?
> >
> >
> > (PS: My XP is installed on D: . My dead 98 is installed on C, but
I can
> not
> > format the drive C in XP now, because a message says: "Windows
can't
> format
> > this drive.Be sure it is not in use or no window from it is
open.."
> > Although no window is open and no program uses that drive...I have
also
> > checked Task Manager, but no Msblast.exe process was
there..although I saw
> > some new processes.......Also checking my XP firewall.. it was
off!.. I am
> > sure I didn't turn it off...)
> >
> > Any Help is Much Regarded
> >
> > PS.2 : I have ran my MacAfee 6 times from that incident occurred
but
> nothing
> > yet......
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
>
>

[T O M M Y]

I have many times tried to install it , but the following error apear as I
double click on the patch ;

"KB823980 Setup Error

""Setup could not verify the integrity of the file update.inf . Make sure
the Cryptographic service is running on this computer.""

Then what can I do...

PS: (This is about 7 hours I am working with my computer after the first
restart, but still no sign of
the worm in my computer by checking with MacAfee...
I have checked Windows XP's registry but there was no "mslaugh.exe" in : "
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
I have rebooted many times to see if the " Restart " message will show up
again...but nothing till now...Also I have set RCS\Recovery\First failure to
"Restart the Service")

Can this be a new kind of Msblast? or it was really a problem with XP ?


"Jupiter Jones [MVP]" > wrote in message
...
> Tommy;
> Did you install the patch?
> Without the patch and if you have an issue with your firewall, your
> chances of getting Blaster any variety go way up:
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
9532-3DE40F69C074&displaylang=en
>
> --
> Jupiter Jones [MVP]
> An easier way to read newsgroup messages:
> http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> http://dts-l.org/index.html
>
>

[Jupiter Jones [MVP]]

Tommy;
Try these one at a time.
Please post back with the solution that resolved it for you.

1. Perform Disk Clean-up checking all boxes except "Compress old
files"
Start/All Programs/Accessories/System Tools/Disk Clean-up

2. Go to Internet Options in the Control Panel:
Delete Cookies
Delete Files (check box "Delete all offline content")
Clear History

3. Reboot, login to an Administrator account.
Double click My Computer.
Double click C drive.
Double click Windows file.
Double click System32 file.
Right click catroot2, click rename, type "catroot2old"
ENTER
Otherwise:
Start the Administrative Tools utility in Control Panel.
Double-click Services.
Right-click Cryptographic Services, and then click Properties.
Click Automatic for Startup type, and then click Start.

4. If Cryptographic Services is already set to Automatic, disable it,
reboot, then go back and set to Automatic.
Reboot

5. Start/Run
Type "msconfig" ENTER
Select "Normal Start-up"
Click OK, follow prompts and reboot

6. Start/Run
Type "cmd" ENTER

a.
Type "net stop cryptsvc" ENTER.
Type "net start cryptsvc" ENTER.
b.
Type "regsvr32 softpub.dll" ENTER.
Type "regsvr32 wintrust.dll" ENTER.
c.
Type "regsvr32 initpki.dll" ENTER.
Type "regsvr32 dssenh.dll" ENTER.
d.
Type "regsvr32 rsaenh.dll" ENTER.
Type "regsvr32 cryptdlg.dll" ENTER.

e.
Type "regsvr32 gpkcsp.dll" ENTER
Type "regsvr32 sccbase.dll" ENTER
Type "regsvr32 slbcsp.dll" ENTER

Close the box and install the patch.

7. Otherwise:
Check for missing/damaged System files:
Start/Run
Type "cmd" ENTER
Type "sfc /scannow" ENTER
Have Windows XP CD nearby.
Reboot when completed.

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://dts-l.org/index.html


"T O M M Y" > wrote in message
...
> I have many times tried to install it , but the following error
apear as I
> double click on the patch ;
>
> "KB823980 Setup Error
>
> ""Setup could not verify the integrity of the file update.inf . Make
sure
> the Cryptographic service is running on this computer.""
>
> Then what can I do...
>
> PS: (This is about 7 hours I am working with my computer after the
first
> restart, but still no sign of
> the worm in my computer by checking with MacAfee...
> I have checked Windows XP's registry but there was no "mslaugh.exe"
in : "
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> I have rebooted many times to see if the " Restart " message will
show up
> again...but nothing till now...Also I have set RCS\Recovery\First
failure to
> "Restart the Service")
>
> Can this be a new kind of Msblast? or it was really a problem with
XP ?
>
>
> "Jupiter Jones [MVP]" > wrote in message
> ...
> > Tommy;
> > Did you install the patch?
> > Without the patch and if you have an issue with your firewall,
your
> > chances of getting Blaster any variety go way up:
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> 9532-3DE40F69C074&displaylang=en
> >
> > --
> > Jupiter Jones [MVP]
> > An easier way to read newsgroup messages:
> > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > http://dts-l.org/index.html
> >
> >
>
>
>
>
>
>
>

[T O M M Y]

Dear Jupiter :

I did all you said and went through all instructions,step by step,....All
command prompt dlls
were successful. But unfortunately the problem still exists. Again the same
message appears when running the service patch. I checked all file systems
and found no problem. The only thing is that I did not rename catroot2
folder, instead performed the next step you said about " Cryptographic
Services ".

Well, I don not know what I should do now. I have also problems updating my
XP. Each time a message says: " The page you are trying to view cannot be
displayed because the server it resides on does not respond. Please try
again later "
And I try again..but nothing.

However I went to XP's update web page. It said the page shall be updated
now, I accepted , but the update failed like other updates.

Regards



"Jupiter Jones [MVP]" > wrote in message
...
> Tommy;
> Try these one at a time.
> Please post back with the solution that resolved it for you.
>
> 1. Perform Disk Clean-up checking all boxes except "Compress old
> files"
> Start/All Programs/Accessories/System Tools/Disk Clean-up
>
> 2. Go to Internet Options in the Control Panel:
> Delete Cookies
> Delete Files (check box "Delete all offline content")
> Clear History
>
> 3. Reboot, login to an Administrator account.
> Double click My Computer.
> Double click C drive.
> Double click Windows file.
> Double click System32 file.
> Right click catroot2, click rename, type "catroot2old"
> ENTER
> Otherwise:
> Start the Administrative Tools utility in Control Panel.
> Double-click Services.
> Right-click Cryptographic Services, and then click Properties.
> Click Automatic for Startup type, and then click Start.
>
> 4. If Cryptographic Services is already set to Automatic, disable it,
> reboot, then go back and set to Automatic.
> Reboot
>
> 5. Start/Run
> Type "msconfig" ENTER
> Select "Normal Start-up"
> Click OK, follow prompts and reboot
>
> 6. Start/Run
> Type "cmd" ENTER
>
> a.
> Type "net stop cryptsvc" ENTER.
> Type "net start cryptsvc" ENTER.
> b.
> Type "regsvr32 softpub.dll" ENTER.
> Type "regsvr32 wintrust.dll" ENTER.
> c.
> Type "regsvr32 initpki.dll" ENTER.
> Type "regsvr32 dssenh.dll" ENTER.
> d.
> Type "regsvr32 rsaenh.dll" ENTER.
> Type "regsvr32 cryptdlg.dll" ENTER.
>
> e.
> Type "regsvr32 gpkcsp.dll" ENTER
> Type "regsvr32 sccbase.dll" ENTER
> Type "regsvr32 slbcsp.dll" ENTER
>
> Close the box and install the patch.
>
> 7. Otherwise:
> Check for missing/damaged System files:
> Start/Run
> Type "cmd" ENTER
> Type "sfc /scannow" ENTER
> Have Windows XP CD nearby.
> Reboot when completed.
>
> --
> Jupiter Jones [MVP]
> An easier way to read newsgroup messages:
> http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> http://dts-l.org/index.html
>
>
> "T O M M Y" > wrote in message
> ...
> > I have many times tried to install it , but the following error
> apear as I
> > double click on the patch ;
> >
> > "KB823980 Setup Error
> >
> > ""Setup could not verify the integrity of the file update.inf . Make
> sure
> > the Cryptographic service is running on this computer.""
> >
> > Then what can I do...
> >
> > PS: (This is about 7 hours I am working with my computer after the
> first
> > restart, but still no sign of
> > the worm in my computer by checking with MacAfee...
> > I have checked Windows XP's registry but there was no "mslaugh.exe"
> in : "
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> > I have rebooted many times to see if the " Restart " message will
> show up
> > again...but nothing till now...Also I have set RCS\Recovery\First
> failure to
> > "Restart the Service")
> >
> > Can this be a new kind of Msblast? or it was really a problem with
> XP ?
> >
> >
> > "Jupiter Jones [MVP]" > wrote in message
> > ...
> > > Tommy;
> > > Did you install the patch?
> > > Without the patch and if you have an issue with your firewall,
> your
> > > chances of getting Blaster any variety go way up:
> > >
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> > 9532-3DE40F69C074&displaylang=en
> > >
> > > --
> > > Jupiter Jones [MVP]
> > > An easier way to read newsgroup messages:
> > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > http://dts-l.org/index.html
> > >
> > >
> >
> >
> >
> >
> >
> >
> >
>
>

[MichaelJennings]

> > Right click catroot2, click rename, type "catroot2old"
Rename catroot2 and see if you can get the updates.

"T O M M Y" > wrote in message
...
> Dear Jupiter :
>
> I did all you said and went through all instructions,step by step,....All
> command prompt dlls
> were successful. But unfortunately the problem still exists. Again the
same
> message appears when running the service patch. I checked all file systems
> and found no problem. The only thing is that I did not rename catroot2
> folder, instead performed the next step you said about " Cryptographic
> Services ".
>
> Well, I don not know what I should do now. I have also problems updating
my
> XP. Each time a message says: " The page you are trying to view cannot be
> displayed because the server it resides on does not respond. Please try
> again later "
> And I try again..but nothing.
>
> However I went to XP's update web page. It said the page shall be updated
> now, I accepted , but the update failed like other updates.
>
> Regards
>
>
>
> "Jupiter Jones [MVP]" > wrote in message
> ...
> > Tommy;
> > Try these one at a time.
> > Please post back with the solution that resolved it for you.
> >
> > 1. Perform Disk Clean-up checking all boxes except "Compress old
> > files"
> > Start/All Programs/Accessories/System Tools/Disk Clean-up
> >
> > 2. Go to Internet Options in the Control Panel:
> > Delete Cookies
> > Delete Files (check box "Delete all offline content")
> > Clear History
> >
> > 3. Reboot, login to an Administrator account.
> > Double click My Computer.
> > Double click C drive.
> > Double click Windows file.
> > Double click System32 file.
> > Right click catroot2, click rename, type "catroot2old"
> > ENTER
> > Otherwise:
> > Start the Administrative Tools utility in Control Panel.
> > Double-click Services.
> > Right-click Cryptographic Services, and then click Properties.
> > Click Automatic for Startup type, and then click Start.
> >
> > 4. If Cryptographic Services is already set to Automatic, disable it,
> > reboot, then go back and set to Automatic.
> > Reboot
> >
> > 5. Start/Run
> > Type "msconfig" ENTER
> > Select "Normal Start-up"
> > Click OK, follow prompts and reboot
> >
> > 6. Start/Run
> > Type "cmd" ENTER
> >
> > a.
> > Type "net stop cryptsvc" ENTER.
> > Type "net start cryptsvc" ENTER.
> > b.
> > Type "regsvr32 softpub.dll" ENTER.
> > Type "regsvr32 wintrust.dll" ENTER.
> > c.
> > Type "regsvr32 initpki.dll" ENTER.
> > Type "regsvr32 dssenh.dll" ENTER.
> > d.
> > Type "regsvr32 rsaenh.dll" ENTER.
> > Type "regsvr32 cryptdlg.dll" ENTER.
> >
> > e.
> > Type "regsvr32 gpkcsp.dll" ENTER
> > Type "regsvr32 sccbase.dll" ENTER
> > Type "regsvr32 slbcsp.dll" ENTER
> >
> > Close the box and install the patch.
> >
> > 7. Otherwise:
> > Check for missing/damaged System files:
> > Start/Run
> > Type "cmd" ENTER
> > Type "sfc /scannow" ENTER
> > Have Windows XP CD nearby.
> > Reboot when completed.
> >
> > --
> > Jupiter Jones [MVP]
> > An easier way to read newsgroup messages:
> > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > http://dts-l.org/index.html
> >
> >
> > "T O M M Y" > wrote in message
> > ...
> > > I have many times tried to install it , but the following error
> > appear as I
> > > double click on the patch ;
> > >
> > > "KB823980 Setup Error
> > >
> > > ""Setup could not verify the integrity of the file update.inf . Make
> > sure
> > > the Cryptographic service is running on this computer.""
> > >
> > > Then what can I do...
> > >
> > > PS: (This is about 7 hours I am working with my computer after the
> > first
> > > restart, but still no sign of
> > > the worm in my computer by checking with MacAfee...
> > > I have checked Windows XP's registry but there was no "mslaugh.exe"
> > in : "
> > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> > > I have rebooted many times to see if the " Restart " message will
> > show up
> > > again...but nothing till now...Also I have set RCS\Recovery\First
> > failure to
> > > "Restart the Service")
> > >
> > > Can this be a new kind of Msblast? or it was really a problem with
> > XP ?
> > >
> > >
> > > "Jupiter Jones [MVP]" > wrote in message
> > > ...
> > > > Tommy;
> > > > Did you install the patch?
> > > > Without the patch and if you have an issue with your firewall,
> > your
> > > > chances of getting Blaster any variety go way up:
> > > >
> > >
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> > > 9532-3DE40F69C074&displaylang=en
> > > >
> > > > --
> > > > Jupiter Jones [MVP]
> > > > An easier way to read newsgroup messages:
> > > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > > http://dts-l.org/index.html
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
>
>
>
>

[Frank Saunders MS-MVP, IE/OE]

Did you make sure that your anti-virus was disabled before the download and
install?

--
Frank Saunders MS-MVP, IE/OE
Please Reply to Newsgroup
www.fjsmjs.com


"T O M M Y" > wrote in message
...
> Dear Jupiter :
>
> I did all you said and went through all instructions,step by step,....All
> command prompt dlls
> were successful. But unfortunately the problem still exists. Again the
same
> message appears when running the service patch. I checked all file systems
> and found no problem. The only thing is that I did not rename catroot2
> folder, instead performed the next step you said about " Cryptographic
> Services ".
>
> Well, I don not know what I should do now. I have also problems updating
my
> XP. Each time a message says: " The page you are trying to view cannot be
> displayed because the server it resides on does not respond. Please try
> again later "
> And I try again..but nothing.
>
> However I went to XP's update web page. It said the page shall be updated
> now, I accepted , but the update failed like other updates.
>
> Regards
>
>
>
> "Jupiter Jones [MVP]" > wrote in message
> ...
> > Tommy;
> > Try these one at a time.
> > Please post back with the solution that resolved it for you.
> >
> > 1. Perform Disk Clean-up checking all boxes except "Compress old
> > files"
> > Start/All Programs/Accessories/System Tools/Disk Clean-up
> >
> > 2. Go to Internet Options in the Control Panel:
> > Delete Cookies
> > Delete Files (check box "Delete all offline content")
> > Clear History
> >
> > 3. Reboot, login to an Administrator account.
> > Double click My Computer.
> > Double click C drive.
> > Double click Windows file.
> > Double click System32 file.
> > Right click catroot2, click rename, type "catroot2old"
> > ENTER
> > Otherwise:
> > Start the Administrative Tools utility in Control Panel.
> > Double-click Services.
> > Right-click Cryptographic Services, and then click Properties.
> > Click Automatic for Startup type, and then click Start.
> >
> > 4. If Cryptographic Services is already set to Automatic, disable it,
> > reboot, then go back and set to Automatic.
> > Reboot
> >
> > 5. Start/Run
> > Type "msconfig" ENTER
> > Select "Normal Start-up"
> > Click OK, follow prompts and reboot
> >
> > 6. Start/Run
> > Type "cmd" ENTER
> >
> > a.
> > Type "net stop cryptsvc" ENTER.
> > Type "net start cryptsvc" ENTER.
> > b.
> > Type "regsvr32 softpub.dll" ENTER.
> > Type "regsvr32 wintrust.dll" ENTER.
> > c.
> > Type "regsvr32 initpki.dll" ENTER.
> > Type "regsvr32 dssenh.dll" ENTER.
> > d.
> > Type "regsvr32 rsaenh.dll" ENTER.
> > Type "regsvr32 cryptdlg.dll" ENTER.
> >
> > e.
> > Type "regsvr32 gpkcsp.dll" ENTER
> > Type "regsvr32 sccbase.dll" ENTER
> > Type "regsvr32 slbcsp.dll" ENTER
> >
> > Close the box and install the patch.
> >
> > 7. Otherwise:
> > Check for missing/damaged System files:
> > Start/Run
> > Type "cmd" ENTER
> > Type "sfc /scannow" ENTER
> > Have Windows XP CD nearby.
> > Reboot when completed.
> >
> > --
> > Jupiter Jones [MVP]
> > An easier way to read newsgroup messages:
> > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > http://dts-l.org/index.html
> >
> >
> > "T O M M Y" > wrote in message
> > ...
> > > I have many times tried to install it , but the following error
> > apear as I
> > > double click on the patch ;
> > >
> > > "KB823980 Setup Error
> > >
> > > ""Setup could not verify the integrity of the file update.inf . Make
> > sure
> > > the Cryptographic service is running on this computer.""
> > >
> > > Then what can I do...
> > >
> > > PS: (This is about 7 hours I am working with my computer after the
> > first
> > > restart, but still no sign of
> > > the worm in my computer by checking with MacAfee...
> > > I have checked Windows XP's registry but there was no "mslaugh.exe"
> > in : "
> > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> > > I have rebooted many times to see if the " Restart " message will
> > show up
> > > again...but nothing till now...Also I have set RCS\Recovery\First
> > failure to
> > > "Restart the Service")
> > >
> > > Can this be a new kind of Msblast? or it was really a problem with
> > XP ?
> > >
> > >
> > > "Jupiter Jones [MVP]" > wrote in message
> > > ...
> > > > Tommy;
> > > > Did you install the patch?
> > > > Without the patch and if you have an issue with your firewall,
> > your
> > > > chances of getting Blaster any variety go way up:
> > > >
> > >
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> > > 9532-3DE40F69C074&displaylang=en
> > > >
> > > > --
> > > > Jupiter Jones [MVP]
> > > > An easier way to read newsgroup messages:
> > > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > > http://dts-l.org/index.html
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
>
>
>
>

[T O M M Y]

Greetings,
dear Jupiter any many thanks for all your guidances :

Recently I visited http://www.updatexp.com/cryptographic-service.html and
followed its instruction for the famous error message when trying to install
the patch. The thing I made was changing System32\Catroot2 to Catroot2old
(the thing you said and I skipped for security!) . Then successfully the
patch was installed.

Now I have questions :

1)As I checked my System32 folder again, I saw both "catroot2" and
"catroot2old" folders beside each other.Well actually I renamed the first
and did NOT create a new folder. DoI have to make any changes there?

2) I have set Remote Call .....First failure to " Restart the service".. Do
I have to set it to the previous setting?

3) And now with the patch installed am I secured from the dirty msblast worm
and is it enough to only use XP's firewall when stepping into Internet ?


Many Thanks for all Helps...

Hope you enjoy your life.

<Good Luck>










"Jupiter Jones [MVP]" > wrote in message
...
> Tommy;
> Try these one at a time.
> Please post back with the solution that resolved it for you.
>
> 1. Perform Disk Clean-up checking all boxes except "Compress old
> files"
> Start/All Programs/Accessories/System Tools/Disk Clean-up
>
> 2. Go to Internet Options in the Control Panel:
> Delete Cookies
> Delete Files (check box "Delete all offline content")
> Clear History
>
> 3. Reboot, login to an Administrator account.
> Double click My Computer.
> Double click C drive.
> Double click Windows file.
> Double click System32 file.
> Right click catroot2, click rename, type "catroot2old"
> ENTER
> Otherwise:
> Start the Administrative Tools utility in Control Panel.
> Double-click Services.
> Right-click Cryptographic Services, and then click Properties.
> Click Automatic for Startup type, and then click Start.
>
> 4. If Cryptographic Services is already set to Automatic, disable it,
> reboot, then go back and set to Automatic.
> Reboot
>
> 5. Start/Run
> Type "msconfig" ENTER
> Select "Normal Start-up"
> Click OK, follow prompts and reboot
>
> 6. Start/Run
> Type "cmd" ENTER
>
> a.
> Type "net stop cryptsvc" ENTER.
> Type "net start cryptsvc" ENTER.
> b.
> Type "regsvr32 softpub.dll" ENTER.
> Type "regsvr32 wintrust.dll" ENTER.
> c.
> Type "regsvr32 initpki.dll" ENTER.
> Type "regsvr32 dssenh.dll" ENTER.
> d.
> Type "regsvr32 rsaenh.dll" ENTER.
> Type "regsvr32 cryptdlg.dll" ENTER.
>
> e.
> Type "regsvr32 gpkcsp.dll" ENTER
> Type "regsvr32 sccbase.dll" ENTER
> Type "regsvr32 slbcsp.dll" ENTER
>
> Close the box and install the patch.
>
> 7. Otherwise:
> Check for missing/damaged System files:
> Start/Run
> Type "cmd" ENTER
> Type "sfc /scannow" ENTER
> Have Windows XP CD nearby.
> Reboot when completed.
>
> --
> Jupiter Jones [MVP]
> An easier way to read newsgroup messages:
> http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> http://dts-l.org/index.html
>
>
> "T O M M Y" > wrote in message
> ...
> > I have many times tried to install it , but the following error
> apear as I
> > double click on the patch ;
> >
> > "KB823980 Setup Error
> >
> > ""Setup could not verify the integrity of the file update.inf . Make
> sure
> > the Cryptographic service is running on this computer.""
> >
> > Then what can I do...
> >
> > PS: (This is about 7 hours I am working with my computer after the
> first
> > restart, but still no sign of
> > the worm in my computer by checking with MacAfee...
> > I have checked Windows XP's registry but there was no "mslaugh.exe"
> in : "
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> > I have rebooted many times to see if the " Restart " message will
> show up
> > again...but nothing till now...Also I have set RCS\Recovery\First
> failure to
> > "Restart the Service")
> >
> > Can this be a new kind of Msblast? or it was really a problem with
> XP ?
> >
> >
> > "Jupiter Jones [MVP]" > wrote in message
> > ...
> > > Tommy;
> > > Did you install the patch?
> > > Without the patch and if you have an issue with your firewall,
> your
> > > chances of getting Blaster any variety go way up:
> > >
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> > 9532-3DE40F69C074&displaylang=en
> > >
> > > --
> > > Jupiter Jones [MVP]
> > > An easier way to read newsgroup messages:
> > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > http://dts-l.org/index.html
> > >
> > >
> >
> >
> >
> >
> >
> >
> >
>
>

[T O M M Y]

Yes
that was the whole problem..
Thanks
"MichaelJennings" > wrote in message
...
> > > Right click catroot2, click rename, type "catroot2old"
> Rename catroot2 and see if you can get the updates.
>
> "T O M M Y" > wrote in message
> ...
> > Dear Jupiter :
> >
> > I did all you said and went through all instructions,step by
step,....All
> > command prompt dlls
> > were successful. But unfortunately the problem still exists. Again the
> same
> > message appears when running the service patch. I checked all file
systems
> > and found no problem. The only thing is that I did not rename catroot2
> > folder, instead performed the next step you said about " Cryptographic
> > Services ".
> >
> > Well, I don not know what I should do now. I have also problems
updating
> my
> > XP. Each time a message says: " The page you are trying to view cannot
be
> > displayed because the server it resides on does not respond. Please try
> > again later "
> > And I try again..but nothing.
> >
> > However I went to XP's update web page. It said the page shall be
updated
> > now, I accepted , but the update failed like other updates.
> >
> > Regards
> >
> >
> >
> > "Jupiter Jones [MVP]" > wrote in message
> > ...
> > > Tommy;
> > > Try these one at a time.
> > > Please post back with the solution that resolved it for you.
> > >
> > > 1. Perform Disk Clean-up checking all boxes except "Compress old
> > > files"
> > > Start/All Programs/Accessories/System Tools/Disk Clean-up
> > >
> > > 2. Go to Internet Options in the Control Panel:
> > > Delete Cookies
> > > Delete Files (check box "Delete all offline content")
> > > Clear History
> > >
> > > 3. Reboot, login to an Administrator account.
> > > Double click My Computer.
> > > Double click C drive.
> > > Double click Windows file.
> > > Double click System32 file.
> > > Right click catroot2, click rename, type "catroot2old"
> > > ENTER
> > > Otherwise:
> > > Start the Administrative Tools utility in Control Panel.
> > > Double-click Services.
> > > Right-click Cryptographic Services, and then click Properties.
> > > Click Automatic for Startup type, and then click Start.
> > >
> > > 4. If Cryptographic Services is already set to Automatic, disable it,
> > > reboot, then go back and set to Automatic.
> > > Reboot
> > >
> > > 5. Start/Run
> > > Type "msconfig" ENTER
> > > Select "Normal Start-up"
> > > Click OK, follow prompts and reboot
> > >
> > > 6. Start/Run
> > > Type "cmd" ENTER
> > >
> > > a.
> > > Type "net stop cryptsvc" ENTER.
> > > Type "net start cryptsvc" ENTER.
> > > b.
> > > Type "regsvr32 softpub.dll" ENTER.
> > > Type "regsvr32 wintrust.dll" ENTER.
> > > c.
> > > Type "regsvr32 initpki.dll" ENTER.
> > > Type "regsvr32 dssenh.dll" ENTER.
> > > d.
> > > Type "regsvr32 rsaenh.dll" ENTER.
> > > Type "regsvr32 cryptdlg.dll" ENTER.
> > >
> > > e.
> > > Type "regsvr32 gpkcsp.dll" ENTER
> > > Type "regsvr32 sccbase.dll" ENTER
> > > Type "regsvr32 slbcsp.dll" ENTER
> > >
> > > Close the box and install the patch.
> > >
> > > 7. Otherwise:
> > > Check for missing/damaged System files:
> > > Start/Run
> > > Type "cmd" ENTER
> > > Type "sfc /scannow" ENTER
> > > Have Windows XP CD nearby.
> > > Reboot when completed.
> > >
> > > --
> > > Jupiter Jones [MVP]
> > > An easier way to read newsgroup messages:
> > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > http://dts-l.org/index.html
> > >
> > >
> > > "T O M M Y" > wrote in message
> > > ...
> > > > I have many times tried to install it , but the following error
> > > appear as I
> > > > double click on the patch ;
> > > >
> > > > "KB823980 Setup Error
> > > >
> > > > ""Setup could not verify the integrity of the file update.inf . Make
> > > sure
> > > > the Cryptographic service is running on this computer.""
> > > >
> > > > Then what can I do...
> > > >
> > > > PS: (This is about 7 hours I am working with my computer after the
> > > first
> > > > restart, but still no sign of
> > > > the worm in my computer by checking with MacAfee...
> > > > I have checked Windows XP's registry but there was no "mslaugh.exe"
> > > in : "
> > > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> > > > I have rebooted many times to see if the " Restart " message will
> > > show up
> > > > again...but nothing till now...Also I have set RCS\Recovery\First
> > > failure to
> > > > "Restart the Service")
> > > >
> > > > Can this be a new kind of Msblast? or it was really a problem with
> > > XP ?
> > > >
> > > >
> > > > "Jupiter Jones [MVP]" > wrote in message
> > > > ...
> > > > > Tommy;
> > > > > Did you install the patch?
> > > > > Without the patch and if you have an issue with your firewall,
> > > your
> > > > > chances of getting Blaster any variety go way up:
> > > > >
> > > >
> > >
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> > > > 9532-3DE40F69C074&displaylang=en
> > > > >
> > > > > --
> > > > > Jupiter Jones [MVP]
> > > > > An easier way to read newsgroup messages:
> > > > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > > > http://dts-l.org/index.html
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
> >
>
>

[T O M M Y]

Dear Frank Saunders, I made changes to Catroot2, then with my MacAfee on
,the patch was installed successfully.

Thanks for all helps from MVPs and other valuable angels.

Best Regards

<T O M M Y>

"Frank Saunders MS-MVP, IE/OE" > wrote in message
...
> Did you make sure that your anti-virus was disabled before the download
and
> install?
>
> --
> Frank Saunders MS-MVP, IE/OE
> Please Reply to Newsgroup
> www.fjsmjs.com
>
>
> "T O M M Y" > wrote in message
> ...
> > Dear Jupiter :
> >
> > I did all you said and went through all instructions,step by
step,....All
> > command prompt dlls
> > were successful. But unfortunately the problem still exists. Again the
> same
> > message appears when running the service patch. I checked all file
systems
> > and found no problem. The only thing is that I did not rename catroot2
> > folder, instead performed the next step you said about " Cryptographic
> > Services ".
> >
> > Well, I don not know what I should do now. I have also problems
updating
> my
> > XP. Each time a message says: " The page you are trying to view cannot
be
> > displayed because the server it resides on does not respond. Please try
> > again later "
> > And I try again..but nothing.
> >
> > However I went to XP's update web page. It said the page shall be
updated
> > now, I accepted , but the update failed like other updates.
> >
> > Regards
> >
> >
> >
> > "Jupiter Jones [MVP]" > wrote in message
> > ...
> > > Tommy;
> > > Try these one at a time.
> > > Please post back with the solution that resolved it for you.
> > >
> > > 1. Perform Disk Clean-up checking all boxes except "Compress old
> > > files"
> > > Start/All Programs/Accessories/System Tools/Disk Clean-up
> > >
> > > 2. Go to Internet Options in the Control Panel:
> > > Delete Cookies
> > > Delete Files (check box "Delete all offline content")
> > > Clear History
> > >
> > > 3. Reboot, login to an Administrator account.
> > > Double click My Computer.
> > > Double click C drive.
> > > Double click Windows file.
> > > Double click System32 file.
> > > Right click catroot2, click rename, type "catroot2old"
> > > ENTER
> > > Otherwise:
> > > Start the Administrative Tools utility in Control Panel.
> > > Double-click Services.
> > > Right-click Cryptographic Services, and then click Properties.
> > > Click Automatic for Startup type, and then click Start.
> > >
> > > 4. If Cryptographic Services is already set to Automatic, disable it,
> > > reboot, then go back and set to Automatic.
> > > Reboot
> > >
> > > 5. Start/Run
> > > Type "msconfig" ENTER
> > > Select "Normal Start-up"
> > > Click OK, follow prompts and reboot
> > >
> > > 6. Start/Run
> > > Type "cmd" ENTER
> > >
> > > a.
> > > Type "net stop cryptsvc" ENTER.
> > > Type "net start cryptsvc" ENTER.
> > > b.
> > > Type "regsvr32 softpub.dll" ENTER.
> > > Type "regsvr32 wintrust.dll" ENTER.
> > > c.
> > > Type "regsvr32 initpki.dll" ENTER.
> > > Type "regsvr32 dssenh.dll" ENTER.
> > > d.
> > > Type "regsvr32 rsaenh.dll" ENTER.
> > > Type "regsvr32 cryptdlg.dll" ENTER.
> > >
> > > e.
> > > Type "regsvr32 gpkcsp.dll" ENTER
> > > Type "regsvr32 sccbase.dll" ENTER
> > > Type "regsvr32 slbcsp.dll" ENTER
> > >
> > > Close the box and install the patch.
> > >
> > > 7. Otherwise:
> > > Check for missing/damaged System files:
> > > Start/Run
> > > Type "cmd" ENTER
> > > Type "sfc /scannow" ENTER
> > > Have Windows XP CD nearby.
> > > Reboot when completed.
> > >
> > > --
> > > Jupiter Jones [MVP]
> > > An easier way to read newsgroup messages:
> > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > http://dts-l.org/index.html
> > >
> > >
> > > "T O M M Y" > wrote in message
> > > ...
> > > > I have many times tried to install it , but the following error
> > > apear as I
> > > > double click on the patch ;
> > > >
> > > > "KB823980 Setup Error
> > > >
> > > > ""Setup could not verify the integrity of the file update.inf . Make
> > > sure
> > > > the Cryptographic service is running on this computer.""
> > > >
> > > > Then what can I do...
> > > >
> > > > PS: (This is about 7 hours I am working with my computer after the
> > > first
> > > > restart, but still no sign of
> > > > the worm in my computer by checking with MacAfee...
> > > > I have checked Windows XP's registry but there was no "mslaugh.exe"
> > > in : "
> > > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "
> > > > I have rebooted many times to see if the " Restart " message will
> > > show up
> > > > again...but nothing till now...Also I have set RCS\Recovery\First
> > > failure to
> > > > "Restart the Service")
> > > >
> > > > Can this be a new kind of Msblast? or it was really a problem with
> > > XP ?
> > > >
> > > >
> > > > "Jupiter Jones [MVP]" > wrote in message
> > > > ...
> > > > > Tommy;
> > > > > Did you install the patch?
> > > > > Without the patch and if you have an issue with your firewall,
> > > your
> > > > > chances of getting Blaster any variety go way up:
> > > > >
> > > >
> > >
> >
>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-
> > > > 9532-3DE40F69C074&displaylang=en
> > > > >
> > > > > --
> > > > > Jupiter Jones [MVP]
> > > > > An easier way to read newsgroup messages:
> > > > > http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
> > > > > http://dts-l.org/index.html
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
> >
>
>

[Jupiter Jones [MVP]]

Your welcome Tommy.
1. No changes are necessary, however if you want you can safely
delete "catroot2old"
2. You can leave it.
3. With the patch successfully installed you computer is reasonably
safe from Blaster.
Also always keep your firewall up.
Install all critical updates as they are available.

To a point "is it enough" although you need to always be alert for
something unusual that may be an indicator of a problem.
The software tools, firewall, anti virus, patches etc, do a lot, but
you need to be aware of what and where the computer is.

Happy surfing.

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://dts-l.org/index.html


"T O M M Y" > wrote in message
.. .
> Greetings,
> dear Jupiter any many thanks for all your guidances :
>
> Recently I visited
http://www.updatexp.com/cryptographic-service.html and
> followed its instruction for the famous error message when trying to
install
> the patch. The thing I made was changing System32\Catroot2 to
Catroot2old
> (the thing you said and I skipped for security!) . Then successfully
the
> patch was installed.
>
> Now I have questions :
>
> 1)As I checked my System32 folder again, I saw both "catroot2" and
> "catroot2old" folders beside each other.Well actually I renamed the
first
> and did NOT create a new folder. DoI have to make any changes there?
>
> 2) I have set Remote Call .....First failure to " Restart the
service".. Do
> I have to set it to the previous setting?
>
> 3) And now with the patch installed am I secured from the dirty
msblast worm
> and is it enough to only use XP's firewall when stepping into
Internet ?
>
>
> Many Thanks for all Helps...
>
> Hope you enjoy your life.
>
> <Good Luck>