Worm

Re: how are you connecting ?

Thanks again chaps this weekend I´ll get my PC sorted.8o

Re: how are you connecting ?

hijackthis is quite handy in addition to stinger (run in safe mode, some virii know how to fool it if they are running).

and of course Mr Russovich's excellent utils from sysinternals.com.

how are you connecting ?

If you are on broadband go out and buy a properish firewall router, less than £100.

then run a software firewall as well. (I like kerio)

def get the tools for specific removal.

When Im looking at a possibly flaky machine I go through the process list and google the name of everything executing.

then go through the registry for the startup programs and google on those as well.

Well thanks for the advice, Im going to try these anti-virus programs out and then stick the patch and a firewall on.

Sounds like you need to run Stinger.

Then you need to patch the machine to the hilt, and install up-to-date AV and firewall.
(Just removing the msblast.exe file doesn't fix it, there's stuff left in the registry to help it "reproduce".)

better

securityresponse.symantec....worm.html

if you're not patched, firewalled, ad-awared, spybotted,

anti-virused, mbsa'd, routed, etc, then you're doomed

have you tried

securityresponse.symantec....tool.html

yet?

Re: sounds nimda-esqe

Well there is a virus checker, but I'm going to download the rpc patch and a firewall.

What caused the problem I think was teekids.exe that is a variant of msblaster.

I deleted teekids but it seems to have left something hanging around.

You wouldn't know what that was ?

sounds nimda-esqe

to me. also sounds like you have a fairly unprotected, unpatched machine?

Re: have you tried

Thanks Scotspine.

I've noticed the virus does file transfers generates TFTPXXX files in my system32 directory.

Does this ring a bell ?

have you tried

procexp.exe from sysinternals,com. it gives more info about users of services, processes etc and might help carify things a bit?

I have a problem on Windows 2000 that everytime I login into the internet through my modem, a svchost process consumes increasing amounts of CPU resources until I have to switch off.

There are now no new obvious executables and I suspect some viral service is being run by the svchost. I can't find any recent dll files.

A few months ago I caught the blaster virus, which I sort of suspect has something to do with it. I removed the msblast executable, but it appears some svchost service remains.

It would even be helpful if I could abort the svchost, which would enable me to download microsoft patches though I^m not sure this would work until I'm free of this worm.

Any help appreciated.