🔒 Locked

Please help me :'(

Started by SavX Mar 22, 2004 at 12:03 PM 16 replies 800+ views

Original Post

Mar 22, 2004 at 12:03 PM

I had to format my harddrive because a virus or something had deleted my task manager. So I used my LEGIT windows disk to reinstall windows XP. Now I have a remote produre call exploit on my computer that shuts my computer down. There is nothing I can do. I have read that it is the same as the MSBlast worm, but I used a file that scans for it and I didn''t find anything. I tried useing windows update, I downloaded the latest patches and installed them. Then I downloaded the blaster remover patch and the patch says I need the latest windows update. But I just installed it and restarted my computer. My comuter keeps getting shut down now and I don''t know what to do. Anyone help me??

Zul

156

Zul

Mar 22, 2004 at 12:12 PM

When you formatted, did you reset the zeroes on your drive? There should be no way for your computer to have gotten re-infected, unless the virus was included in another piece of software you installed. Did you just install the OS, or did you reinstall all of your programs?

tHiSiSbOb

111

tHiSiSbOb

Mar 22, 2004 at 12:12 PM

It could be some driver issue...Try updating drivers for your video/sound card (or any other hardware for that matter).

SavX

Author

SavX

Mar 22, 2004 at 12:25 PM

Did I reset the zeros on my drive? What do you mean? I put my windows disk in and restarted my computer, and followed the options to format and install from there.

I have updated my graphic card and sound cards drivers but still no change. Also, my router now will not connect. Could an infection still be on my computer? And how could I get rid of it?

I haven''t installed all my programs back, the problems start from when I first start up with a empty Windows XP.

Also, I have installed Norton Anti-virus 2003 and Norton Firewall 2003, which both installed successfully. But when I load up both of them, they appear and 10 seconds later dissapear. I can''t get them to stay up long enough to scan my system. Both anti-virus and firewall do this.

Also, with one of the windows updates, the same thing happens. It says it is inspecting my computer then dissapears and nothing else happens.

:\

Sneftel

296

Sneftel

Mar 22, 2004 at 12:27 PM

In terms of getting antivirus software to run, your best bet is to boot into safe mode.

"Sneftel is correct, if rather vulgar." --Flarelocke

1337Haxor

Mar 22, 2004 at 12:42 PM

IMHO this is the easiest way of fixing it (i fixed my friends computer this way too same problem)

UNPLUG FROM TEH INTARENTZ! Reformat (again). Reinstall Windows (again). Install antivirus software (again). Install firewall software or insure the windows one is on (again). PLUG EN TO TEH INTARNETZZ! Update virus software (again). Go to GDnet (again)

Edit: Before going to GDnet (again), update Windows (again)
--Teh 1337 Hax0r
Make MMORPGs Carry Out Your Dreams!
Original post by Oluseyi
I swear, some of you act as if GameDev were a universal clearinghouse...

[edited by - 1337haxor on March 22, 2004 1:42:47 PM]

Zul

156

Zul

Mar 22, 2004 at 12:49 PM

quote:
Original post by SavX
Did I reset the zeros on my drive? What do you mean? I put my windows disk in and restarted my computer, and followed the options to format and install from there.

:\

It''s generally better to use a different utility for formatting your drive than the native Windoze utilities. For a Western Digital drive, they have software called ezdrive which you can copy to a floppy and run from your a drive on start up. If you have a different brand drive, you might still be able to use WD''s utility, or get one specific for your drive. Setting the zeroes means that the utility resets all bits on the drive back to 0, whereas a regular format might not do this. It''s just a cleaner way to start when you''re reinstalling.

DakeDesu

149

DakeDesu

Mar 22, 2004 at 12:58 PM

If you really want to get paranoid (no, this isn''t a typical "use linux" post, read it further), get a Linux Distro, and reformat your entire harddrive in ext3. Then, while unplugged from the internet, reinstall windows (formatting appropiately), then your virus software and firewall software of choice. You might want to purchase the latest store version of these (if you have not already got it).

Once you have completed this task, you can plug your computer into the internet, and download the appropiate patchs.

temp_ie_cant_thinkof_name

Mar 22, 2004 at 1:06 PM

After you format and everything, either take out the BIOS backup battery or change a jumper around on your mobo as specified in your mobo manual. If taking out the battery, you may need to wait anywhere from 5 minutes to an indefinite amount of time to drain the capacitor that goes with the BIOS chip. Doing this will reset your BIOS memory, in case a virus was written to that as well.

fredizzimo

Mar 22, 2004 at 1:12 PM

It''s probably getting infected as soon as the fresh install starts. I recommend that you download the service pack and all windows updates after that and save them on a cd. Also save the latest antivirus update to that cd. Then unplug the network cable, reinstall windows, install the updates, and antivirus.

After that it should be safe to plugin the network cable again.

andy-pandy

103

andy-pandy

Mar 22, 2004 at 1:26 PM

There is no need to reinstall windows because of this. Upon a fresh install, if your computer is infected use services.msc and go to Remote Procedure Call -> Properties -> Recovery.

There are three drop down menus that indicate what windows should do if RPC fails, change all of these options to "Take No Action".

This serves as a temporary fix which gives you time to get rid of the worm.

DakeDesu

149

DakeDesu

Mar 22, 2004 at 1:50 PM

Now that most other avenues are covered, what happens if it has infected the boot sector (which normally is not touched when formatting the harddrive, unless formatting into DD mode, or Dangerously Dedicated mode)?

SavX

Author

SavX

Mar 22, 2004 at 1:59 PM

Hmm.. I''ve been connected to the internet every time :| Forgot about that.. I think I''ll format again... Thanks for all the help

andy-pandy

103

andy-pandy

Mar 22, 2004 at 2:02 PM

The Blaster worm does not need to be present on your hard drive to crash your machine. If you just reinstalled Windows, it''s likely that you have been subject to attacks from an infected machine somewhere.

Coincidentally, I reinstalled Windows today and got the exact same problem. Having had this problem last year, I knew what to do.

Baloogan

Mar 22, 2004 at 5:01 PM

Linux

Deranged

240

Deranged

Mar 22, 2004 at 5:05 PM

lol 1337 got banned, i guess the mods are mroe umm 1337.

well anyways when it starts shutting down, open up a command promt, and type shutdown -a. that will abort the shutdown and let you fix the problem.

Sharp Basic - Coming summer 2004!
typedef unsigned long long int me;
typedef signed short char you;

DakeDesu

149

DakeDesu

Mar 22, 2004 at 5:24 PM

quote:
Original post by Baloogan
Linux

Were you here when staff started making that a bannable offense. Some people know and understand Windows much better than Linux. In some cases Linux is not even an applicable solution.

No, I am not one of those Microsoft tramps myself, I just watch the mods go psycho after the whole "use linux" posts started getting a little out of hand. I personally attempt to use Free Software and Open Source Software exclusively, but I can understand that some people prefer Windows more for some estrange reason.

-=-
DakeDesu :: More woman than you can handle... wait, does this signature make me look fat?
Variables Coming sometime in the near future. Yes! Before Duke Nukem Forever comes out (quit asking that!)
Sliced Bread I really need to do more coding on this
Okay, love you, goodbye!

Doc

Mar 22, 2004 at 11:47 PM

quote:
Original post by DakeDesu
quote:
Original post by Baloogan
Linux

Were you here when staff started making that a bannable offense.

Holy shit, when did that happen? I''d better watch myself...

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.