msblast: virus or feature ?
-
1 year ago I did dual boot install for Windows NT 4 SP 5 and Windows XP Pro on 2 different partitions C & D This worked fine for about 1 year, I did GHOST backups of the partitions & re-installed from ghost images a few times all works fine !!! then about 1 month ago I added USB PCI card & had to do some WXP hardware install crap and now I get goofy error messages from NT AUTHORITY (or something) saying bug in RPC, system shutdown in 60 seconds this is modeless popup & yes system does shut down !!! i rebooted then I noticed a new proc MSBLAST.EXE in task-mgr, found 2 new files in WINNT\SYSTEM32 MSBLAST.EXE and some DBL file (I'm on NT now & can't see the FAT32 drive for WXP) and then rebooting WXP asked me to "register" my OS because it changed NOW THE DAMN THING KEEPS REBOOTING BECAUSE OF THIS MSBLAST/RPC failure crap !!! Is is a virus or just of bug in MS auto-check anti-virus stuff ? I know MS has some security that checks HW config, but I re-registered & this still happening. Even after I reinstalled clean images from GHOST.... It's like the MS security code is working well enough to detect my HW changes, but then it craps out & prevents WXP from running I tried GOOGLE MSDN CP for MSBLAST but no luck...... any ideas besides re-installing everything from scratch ??
-
1 year ago I did dual boot install for Windows NT 4 SP 5 and Windows XP Pro on 2 different partitions C & D This worked fine for about 1 year, I did GHOST backups of the partitions & re-installed from ghost images a few times all works fine !!! then about 1 month ago I added USB PCI card & had to do some WXP hardware install crap and now I get goofy error messages from NT AUTHORITY (or something) saying bug in RPC, system shutdown in 60 seconds this is modeless popup & yes system does shut down !!! i rebooted then I noticed a new proc MSBLAST.EXE in task-mgr, found 2 new files in WINNT\SYSTEM32 MSBLAST.EXE and some DBL file (I'm on NT now & can't see the FAT32 drive for WXP) and then rebooting WXP asked me to "register" my OS because it changed NOW THE DAMN THING KEEPS REBOOTING BECAUSE OF THIS MSBLAST/RPC failure crap !!! Is is a virus or just of bug in MS auto-check anti-virus stuff ? I know MS has some security that checks HW config, but I re-registered & this still happening. Even after I reinstalled clean images from GHOST.... It's like the MS security code is working well enough to detect my HW changes, but then it craps out & prevents WXP from running I tried GOOGLE MSDN CP for MSBLAST but no luck...... any ideas besides re-installing everything from scratch ??
Weird, I read your post earlier and wasn't able to respond (short of googling the 'net, which you claim to have done), and lo and behold my ISP just sent out an email about Win32.Blaster.Worm, which more info at http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html . Hope that helps!
-----BEGIN GEEK CODE BLOCK----- Version: 3.21 GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++ -----END GEEK CODE BLOCK-----
-
Weird, I read your post earlier and wasn't able to respond (short of googling the 'net, which you claim to have done), and lo and behold my ISP just sent out an email about Win32.Blaster.Worm, which more info at http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html . Hope that helps!
-----BEGIN GEEK CODE BLOCK----- Version: 3.21 GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++ -----END GEEK CODE BLOCK-----
-
I think that's it !! Now I wonder how it got onto my PC ?? To fix it so far, I yanked my USB PCI card & re-installed from ghost images. Maybe the USB PCI install did something funny..... Thanks again !!
This is a worm, so either it was in the driver software (VERY unlikely) or it came through something attached to the USB hub, like a USB NIC. Do you have something like that? This is a problem especially if you're on an ISP such as DSL or cable modem where a great majority of the users shouldn't even own a computer and are wide open for attack.
-----BEGIN GEEK CODE BLOCK----- Version: 3.21 GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++ -----END GEEK CODE BLOCK-----
-
1 year ago I did dual boot install for Windows NT 4 SP 5 and Windows XP Pro on 2 different partitions C & D This worked fine for about 1 year, I did GHOST backups of the partitions & re-installed from ghost images a few times all works fine !!! then about 1 month ago I added USB PCI card & had to do some WXP hardware install crap and now I get goofy error messages from NT AUTHORITY (or something) saying bug in RPC, system shutdown in 60 seconds this is modeless popup & yes system does shut down !!! i rebooted then I noticed a new proc MSBLAST.EXE in task-mgr, found 2 new files in WINNT\SYSTEM32 MSBLAST.EXE and some DBL file (I'm on NT now & can't see the FAT32 drive for WXP) and then rebooting WXP asked me to "register" my OS because it changed NOW THE DAMN THING KEEPS REBOOTING BECAUSE OF THIS MSBLAST/RPC failure crap !!! Is is a virus or just of bug in MS auto-check anti-virus stuff ? I know MS has some security that checks HW config, but I re-registered & this still happening. Even after I reinstalled clean images from GHOST.... It's like the MS security code is working well enough to detect my HW changes, but then it craps out & prevents WXP from running I tried GOOGLE MSDN CP for MSBLAST but no luck...... any ideas besides re-installing everything from scratch ??
I am also having the same problem. Did u manage to solve it? I tried deleting those files related to msblast and i am awaiting to see if the problem is still there. Weiye, Chen When pursuing your dreams, don't forget to enjoy your life...
-
I am also having the same problem. Did u manage to solve it? I tried deleting those files related to msblast and i am awaiting to see if the problem is still there. Weiye, Chen When pursuing your dreams, don't forget to enjoy your life...
-
I am also having the same problem. Did u manage to solve it? I tried deleting those files related to msblast and i am awaiting to see if the problem is still there. Weiye, Chen When pursuing your dreams, don't forget to enjoy your life...
deleting the files did not work for me, I had to then "re-register" my PC at microsoft-central.... definitely causes my Windows XP Pro to crash tho, here's some links I got from my ISP & microsoft //securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html //www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp I downloaded the security fix for this RPC bug & will try it shortly, only about 1.3mb size and it doesn't seem to zap my NT4 SP5 system, which I'm using now & for some reason CP doesn't have the clickety links for IE4.0 ??
-
1 year ago I did dual boot install for Windows NT 4 SP 5 and Windows XP Pro on 2 different partitions C & D This worked fine for about 1 year, I did GHOST backups of the partitions & re-installed from ghost images a few times all works fine !!! then about 1 month ago I added USB PCI card & had to do some WXP hardware install crap and now I get goofy error messages from NT AUTHORITY (or something) saying bug in RPC, system shutdown in 60 seconds this is modeless popup & yes system does shut down !!! i rebooted then I noticed a new proc MSBLAST.EXE in task-mgr, found 2 new files in WINNT\SYSTEM32 MSBLAST.EXE and some DBL file (I'm on NT now & can't see the FAT32 drive for WXP) and then rebooting WXP asked me to "register" my OS because it changed NOW THE DAMN THING KEEPS REBOOTING BECAUSE OF THIS MSBLAST/RPC failure crap !!! Is is a virus or just of bug in MS auto-check anti-virus stuff ? I know MS has some security that checks HW config, but I re-registered & this still happening. Even after I reinstalled clean images from GHOST.... It's like the MS security code is working well enough to detect my HW changes, but then it craps out & prevents WXP from running I tried GOOGLE MSDN CP for MSBLAST but no luck...... any ideas besides re-installing everything from scratch ??
Hmm, my dads computer started doing this a few days ago. I would have never guessed it. I'm searching the HD for msblast. But its weird I am having problems with it reading a the Windows CD, could be virus and coincidental hardware failure Matt Newman
Sonork: 100:11179 "Whoa, that ruled! What function key do I gotta press to get that to happen again?" - Strong Bad -
1 year ago I did dual boot install for Windows NT 4 SP 5 and Windows XP Pro on 2 different partitions C & D This worked fine for about 1 year, I did GHOST backups of the partitions & re-installed from ghost images a few times all works fine !!! then about 1 month ago I added USB PCI card & had to do some WXP hardware install crap and now I get goofy error messages from NT AUTHORITY (or something) saying bug in RPC, system shutdown in 60 seconds this is modeless popup & yes system does shut down !!! i rebooted then I noticed a new proc MSBLAST.EXE in task-mgr, found 2 new files in WINNT\SYSTEM32 MSBLAST.EXE and some DBL file (I'm on NT now & can't see the FAT32 drive for WXP) and then rebooting WXP asked me to "register" my OS because it changed NOW THE DAMN THING KEEPS REBOOTING BECAUSE OF THIS MSBLAST/RPC failure crap !!! Is is a virus or just of bug in MS auto-check anti-virus stuff ? I know MS has some security that checks HW config, but I re-registered & this still happening. Even after I reinstalled clean images from GHOST.... It's like the MS security code is working well enough to detect my HW changes, but then it craps out & prevents WXP from running I tried GOOGLE MSDN CP for MSBLAST but no luck...... any ideas besides re-installing everything from scratch ??