PC loop

  • Thread starter Thread starter lobster
  • Start date Start date
L

lobster

Got a bug ,worm or hijack, ran spyware found 7 spywares
use beta to delete them. PC now in a loop getting
NT/SYSTEM/Authuiorty shutting me down due RPC time out in
1 min, acts like a blaster worm , can't get to desk top,
loop keeps shutting me down and reboots. tryed removel
tool(no varmint found), any help at all will be accepted
(before i do a complete reinstall of system)

Might have a corrupte Reg now not sure am gussing at
this point.
 
lobster said:
Got a bug ,worm or hijack, ran spyware found 7 spywares
use beta to delete them. PC now in a loop getting
NT/SYSTEM/Authuiorty shutting me down due RPC time out in
1 min, acts like a blaster worm , can't get to desk top,
loop keeps shutting me down and reboots. tryed removel
tool(no varmint found), any help at all will be accepted
(before i do a complete reinstall of system)

Might have a corrupte Reg now not sure am gussing at
this point.
Click to expand...

Hi

Sasser also gives this, when you scan you open up different
"Junk" files.

Try this, Start - Run write "shutdown -a" without quotes, this
stops shutdown process.

Try to download Stinger, http://vil.nai.com/vil/stinger/
and clean.

Also run Housecall:

http://housecall.trendmicro.com/

You probably will see that you have missed a lot of patches
from MS.

Go to Windowsupdate and follow this:
http://www.microsoft.com/protect
 
-----Original Message-----
Got a bug ,worm or hijack, ran spyware found 7 spywares
use beta to delete them. PC now in a loop getting
NT/SYSTEM/Authuiorty shutting me down due RPC time out in
1 min, acts like a blaster worm , can't get to desk top,
loop keeps shutting me down and reboots. tryed removel
tool(no varmint found), any help at all will be accepted
(before i do a complete reinstall of system)

Might have a corrupte Reg now not sure am gussing at
this point.
.
Add on can't get pc into safe mode will not load
Click to expand...
OS- Win-xp professional with sp-2
 
Add on can't get pc into safe mode will not load
OS- Win-xp professional with sp-2
Click to expand...

Hi Lobster

If you are on SP2 this is important for MS to know.

This can be a bug, I´ve seen this before and perhaps
there is something about RPC and MSAS.
 
-----Original Message-----



Hi Lobster

If you are on SP2 this is important for MS to know.

This can be a bug, I´ve seen this before and perhaps
there is something about RPC and MSAS.
Click to expand...
acts like MSB--MS03-026,MSO3-001
w32.hllw.Gaobot.AA,Backdoor.Agobot.3f[Kaspersky]
Worm
201,216 bytes

This loop started after useing syeware program from
Microsoft, it found, 1800, Nx2, webinhanser 4 others all
minor and deleted them on reboot this loop started acted
like a triggger was started when it was being remove from
system(guessing)
bytes
 
lobster said:
got about a hour and a half
Click to expand...

acts like MSB--MS03-026,MSO3-001
w32.hllw.Gaobot.AA,Backdoor.Agobot.3f[Kaspersky]
Worm
201,216 bytes

This loop started after useing syeware program from
Microsoft, it found, 1800, Nx2, webinhanser 4 others all
minor and deleted them on reboot this loop started acted
like a triggger was started when it was being remove from
system(guessing)
bytes
Click to expand...

Hi

Wait for Bill !

This is probably a nasty bug within removal process.
 
plun said:
lobster said:
got about a hour and a half
Click to expand...


acts like MSB--MS03-026,MSO3-001
w32.hllw.Gaobot.AA,Backdoor.Agobot.3f[Kaspersky]
Worm
201,216 bytes

This loop started after useing syeware program from Microsoft, it
found, 1800, Nx2, webinhanser 4 others all minor and deleted them on
reboot this loop started acted like a triggger was started when it was
being remove from system(guessing)
bytes
Click to expand...
Click to expand...

Hi

This is your way out of this I think.

1- System restore from command promt:
http://support.microsoft.com/kb/304449/en-us

If this works, choose a restorepoint after install of MSAS
but before removal.


2- If above doesnt work.
http://michaelstevenstech.com/XPrepairinstall.htm


Cleaner.log within /Program files/MSAS is interresting so
don´t remove it.
 
I'm going to punt on this one--not sure how that translates internationally,
but to use another American idiom, I'm going to pass the buck.

I say call Microsoft PSS.

They cannot provide support for Microsoft Antispyware, but if you had called
their free support line and asked for help removing spyware, Microsoft
Antivirus is what they'd have had you try.

So---describe the current symptom you are seeing, state that it is a result
of cleaning spyware, and see how it goes from there.

You need to look up the nearest Microsoft support phone number for where you
are--doesn't matter if it is a pay-per-incident number or not--but when they
answer, state that you are looking for the free help available for removal
of Viruses or with security patches.

Unfortunately it is more difficult than it should be for me to look up the
phone number for you--please write back if you can't spot it quickly.

The folks on these phone lines are pros, and will stick with you and get
this fixed. Some problems are better worked in a medium other than these
groups.
 
Bill said:
I'm going to punt on this one--not sure how that translates internationally,
but to use another American idiom, I'm going to pass the buck.

I say call Microsoft PSS.
Click to expand...

?

This is maybe a removal bug ?!?

Strange way to handle Beta issues !
 
There is no support for a beta. In a technical beta, you can at least get
some commiseration from your fellow technical testers, and even, perhaps,
advice from the vendor about what to do. The public betas that I have
bothered to read the newsgroups about have been complete free for alls--I
really haven't looked closely at them, but I think this group probably has
well above average participation by "regulars." and percentage of accurate
responses to questions.

I think free support from PSS for these issues is a good deal for
everyone--and I would have spoken up about it in more cases earlier had I
been clear what the policy is. They can't provide support for the beta
product. However, if you have an issue which could be spyware, running
Microsoft Antispyware will be their first suggestion, so an issue resulting
from removal qualifies for help.

Now--about what has gone wrong--It sure looks like a worm, but as I recall
there are some other issues that can invoke these symptoms--but that
recollection is pretty vague. It's been many months since I've dealt
regularly with this set of symptoms, so I don't have a list on hand from
most likely to least likely.

The PSS support folks are pros--they know how to get this fixed with the
minimum amount of risk to data and time consumed. The folks who have taken
this route in the beta so far have had good experiences, mainly. There were
some posts early on where folks were turned down for free support because of
the "unsupported beta" issue, but I now understand that was counter to
policy--somebody didn't understand the policies at the time.

I wouldn't recommend this except for "my machine is down" problems, or
problems more complex to fix than we typically can solve here--there have
been a couple of folks with keyloggers in place that I've referred--removing
these and keeping the keyboard functional isn't easy.

As I think about it, we could be referring some other folks If they have a
significant issue--Chris, with the Agobot variant, for example--and are
leery of going to third-parties for help, calling PSS is a logical thing for
them to do--I didn't think of it in that thread. Someone with a problem
which we know how to solve, but which requires steps that may be beyond
their capability to easily follow--significant Registry editing, for
example, might be candidates for phone support.

Newsgroups work pretty well for people with enough technical background to
describe their problem reasonably clearly, and follow perhaps imperfectly
defined steps to a solution.

You know from what you've read here though that lots of folks don't manage
that first part well, and we can only guess about the second in the absence
of further responses in a given thread.
 
Bill Sanderson wrote a lot of wisdom about support :

;)

I´m not writing about support, I am sure that
my advices helps him without PSS support.

Can it maybe be interresting for anyone to look
at his cleaner.log, is it maybe a bug ?

You install MSAS and this makes a PC not working even in
safe mode........ !?!

Some MSFT person was "lurking" around about this earlier
I think.

EOD discussion for me.
 
There's definitely an issue of some sort here--he isn't the first to post
here with these symptoms--there may have been perhaps a dozen or so such
posts--they are not very frequent, but they do come up. His is the first I
can recall which was clearly XP SP2, and not Windows 2000.

Yes, knowing more about what happened--from the cleaner log, might well be
useful. The obvious question is did spyware removal, or some operation
undertaken by the user in attempting to recover from spyware removal, leave
him up on the Internet without a firewall. And even then, this symptom
shouldn't happen as a result of a worm--unless the system isn't fully
patched.

Again--direct contact with PSS may be the best way of getting that
information fed back to the developers. I don't know this, but if they need
more information about such situations, I would expect them to have alerted
PSS staff who might see such situations.
 
Back
Top