MS Blast. help needed.

  phil 21:26 26 Sep 2003

A friend asked me to look at his machine and after he told me what was happening it was obvious that he'd got MS Blast.

Went to see it and ran his AVG. Came up with MS Blast & Lovsan.
These two had come up every day for the past two weeks and every day AVG deleted it but still it comes back.

Went onto Windows Update to try and download the removal tool but all I got was, 'Your ActiveX controls are inactive. Update cannot continue'.

Went onto the Symantec site to get the tool from there. While I was there I read the FAQ's where it said that as one of it's tricks MS B blocks access to Windows Update by disabling ActiveX.

Downloaded the tool but when I tried to run it a box came up saying it was an unsigned ActiveX script and could not run. AVG then burst into action and deleted MS Blast and Lovsan again!!!

Went into the security settings and set all security to 'low' so that ActiveX would allow unsigned scripts.
No good, it still wouldn't run.

The PC still shuts down, with the telltale clock box, and he also can't use his CD RW to back up files. Probably because of the ActiveX problems.

Is he looking at a full wipe out and re-install here?

  LastChip 21:47 26 Sep 2003

There are a few of issues here that may help you to clean this machine.

First. Did you download the Symantec tool onto a clean machine? When a virus like this is active, there is no telling what it is getting up to and it essential you download onto a verified clean floppy and then write protect it. The only way you can be sure of this, is to use an un-infected machine.

Second. Did you boot his machine into safe mode and disable system restore BEFORE trying to clean it? There is a known issue regarding this, and I believe it is the only way to eradicate this virus.

Third. If you read the Symantec site, there is an option to stop the virus with a registry hack and deletion of the primary executable file (MSBLAST.exe). This option does work, (I've used it) and then gives you the option to run up to date anti-virus software to clean out any remnants.

  Kitz E Kat 22:00 26 Sep 2003

Last Chip....

You should also load the MS security patch first then load the Norton Fix for the MS Blast

  xania 22:38 26 Sep 2003

In fact you should find that loading the security patch will stop the virus in its tracks. You can then remove it at your leisure.

  phil 21:53 27 Sep 2003

Thank you everyone for your answers.

I have now downloaded the bits needed onto a floppy and will be sorting my friends PC out in the coming week.

I'll let you know how I get on.

  phil 20:54 07 Oct 2003

I tried all the cures but without any luck.

AVG reported no virus present.
FixBlast from Symantec found no virus.
The Microsoft patch doesn't work because I get a message saying it's not a Cryptographic file????. Those are my question marks.

I still couldn't use Windows Update because of the Active X problem and the PC still closes down with AVG coming up with a virus warning and then the countdown box appears.

Once it reboots I ran AVG again and it reports no viruses.

I have now decided to re-install XP.

  xania 16:58 14 Oct 2003

The problkem lies in the fact that you have been unable to install that security patch. This is also stopping your virus checker from seeing the virus. As soon as you you re-install XP, get that security patch installed and you can say goodbye to Blaster!!!

  Jester2K II 17:46 14 Oct 2003

I get a message saying it's not a Cryptographic file????.

There are plenty of threads about how to fix that here!

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Moto G6 Play Review: First Look

The best smart speaker: Apple HomePod vs Google Home vs Amazon Echo

Augmentation du tabac : les meilleures applications pour arrĂȘter de fumer