Worm

[BlasterBates]

I have a problem on Windows 2000 that everytime I login into the internet through my modem, a svchost process consumes increasing amounts of CPU resources until I have to switch off.

There are now no new obvious executables and I suspect some viral service is being run by the svchost. I can't find any recent dll files.

A few months ago I caught the blaster virus, which I sort of suspect has something to do with it. I removed the msblast executable, but it appears some svchost service remains.

It would even be helpful if I could abort the svchost, which would enable me to download microsoft patches though I^m not sure this would work until I'm free of this worm.

Any help appreciated.

[ScotsPine]

have you tried

procexp.exe from sysinternals,com. it gives more info about users of services, processes etc and might help carify things a bit?

[BlasterBates]

Re: have you tried

Thanks Scotspine.

I've noticed the virus does file transfers generates TFTPXXX files in my system32 directory.

Does this ring a bell ?

[ScotsPine]

sounds nimda-esqe

to me. also sounds like you have a fairly unprotected, unpatched machine?

[BlasterBates]

Re: sounds nimda-esqe

Well there is a virus checker, but I'm going to download the rpc patch and a firewall.

What caused the problem I think was teekids.exe that is a variant of msblaster.

I deleted teekids but it seems to have left something hanging around.

You wouldn't know what that was ?

[ScotsPine]

if you're not patched, firewalled, ad-awared, spybotted,

anti-virused, mbsa'd, routed, etc, then you're doomed

have you tried

securityresponse.symantec....tool.html

yet?

[ScotsPine]

better

securityresponse.symantec....worm.html

[Mordac]

Sounds like you need to run Stinger.

Then you need to patch the machine to the hilt, and install up-to-date AV and firewall.
(Just removing the msblast.exe file doesn't fix it, there's stuff left in the registry to help it "reproduce".)

[BlasterBates]

Well thanks for the advice, Im going to try these anti-virus programs out and then stick the patch and a firewall on.

[Mark Snowdon]

how are you connecting ?

If you are on broadband go out and buy a properish firewall router, less than £100.

then run a software firewall as well. (I like kerio)

def get the tools for specific removal.

When Im looking at a possibly flaky machine I go through the process list and google the name of everything executing.

then go through the registry for the startup programs and google on those as well.