help my compter keeps re...

[mrflibbles]

restarting...?

No shut down or anything, just like ive hit the reset switch. It only happens when connected to the internet.

Ive just formatted the thing and installed XP, the only other programs i have are KazaaLite and Zone Alarm.

Any ideas? Its very irritating when it does it mid post!

Cheers,
MrF

[GregE240]

Sounds like MS Blaster to me.

[Don]

Yep. You've got Blaster. Its a pain in the a**e. Suggest you get a hold of the Blaster removal tool from Symantec..You'll also need to get a host of service packs which remove the weakness in Windows that it exploits...and then make sure you're running the latest Anti-Virus stuff too.

Let us know how you get on...

[mrflibbles]

What? eh? That sounds bad

Assuming its some kind of virus, Ive formatted my computer, so how can it still linger?

How do i get rid of it?

And also, bollocks.

[meeja]

mrflibbles said:

What? eh? That sounds bad Assuming its some kind of virus, Ive formatted my computer, so how can it still linger? How do i get rid of it?

www.microsoft.com/security/incident/blast.asp

mrflibbles said:

And also, bollocks.

Quite.

[Don]

mrflibbles said:

What? eh? That sounds bad Assuming its some kind of virus, Ive formatted my computer, so how can it still linger? How do i get rid of it? And also, bollocks.

I'll you put on XP from CD, yes? Did it first appear after you went on line for the first time? If so then Greg and mine diagnostic is pretty likely. If not - then you need another theory, sorry.

How you get rid of it: Try this link

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Or go to Symantec's web site and search for Blaster. And follow the instructions. Its a right pain in the a**e. Once you have got it to stop rebooting then point your browser at

www.windowsupdate.com

And download and install everything it asks for. Hopefully during this time you won't get reinfected - which is a real possibility and a total pain - as then you have to start again...

And then buy yourself some proper AV software and install it, run it, update it regularly. And visit the windowsupdate site at least once a week...

Its the only way...

[mrflibbles]

The plot thickens...

Ive ran the software (cheers guys) and MS Blaster was not detected.

any more ideas?

I thought it was down to Kazaa, but its just happened, when Kazaa was not running.

isnt technology wonderful?

[Don]

mrflibbles said:

And also, bollocks.

Agree totally. I curse the virus writers who waste innocent parties time like this. My elderly parents now live in fear of being connected to the Internet in case they get a virus again and it stops their e-mail from working. When it goes wrong I have to drive 260 miles to get to their house to clean up the mess and it takes a weekend at least as they have a 48Kbps modem link to the net for obtaining updates. Its heartbreaking for them as they do not have the technical understanding to correct the problem and it denies them an essential link to their family.

I curse the virus writers. I curse their forbears and I curse their children, even unto the third generation. I curse the ground they walk on and the air they breathe. I curse their underpants - may they become infested with lice. I curse their T-shirts - may the fleas of a thousand rabid dogs take up residence there on a permanent basis. I curse their computers and I curse their twisted idea of fun. May they spend unpleasant nights in hokey with Big Jim "yous my little puppy naaawww" "Splitter" McGraw and I hope the soap in prison shower has no lubricant qualities.

etc etc etc.

[Don]

mrflibbles said:

The plot thickens... Ive ran the software (cheers guys) and MS Blaster was not detected. any more ideas?

Hmmmn. Start off by getting the latest Virus Definitions and then running a scan. That should provide some more information.

Do you still have the problem?

[mrflibbles]

Ok, ive had a look on the Microsoft website, and noted that MS Blaster has something to do with Remote Procedure Calls (RPC).

I previously had Win98 which always used to crash with the RPC thing. And XP sometimes gives the same error.

Could the blaster still be at large?

[ErnestM]

Welchia methinks...

W32.Welchia...

See here...
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

Easy to verify. See if you have a winserver service running. Chances are - if you do it's welchia...

ErnestM

[mrflibbles]

ErnestM said:

Welchia methinks... Easy to verify. See if you have a winserver service running. Chances are - if you do it's welchia... ErnestM

how do i do that then?

[Bodo]

Don said:

Agree totally. I curse the virus writers who waste innocent parties time like this. My elderly parents now live in fear of being connected to the Internet in case they get a virus again and it stops their e-mail from working. When it goes wrong I have to drive 260 miles to get to their house to clean up the mess and it takes a weekend at least as they have a 48Kbps modem link to the net for obtaining updates. Its heartbreaking for them as they do not have the technical understanding to correct the problem and it denies them an essential link to their family.

Don, I left my parents with Linux on their computers, since they only do email, browsing, digital photo archiving and office stuff.

Once installed, I never had to come around to fix anything on their computers for two years now (only doing a new installation, when they bought new PCs).

I hestitated to do that, but they had no problems with migrating the O/S, because they only do basic stuff on their computers and couldn't really see a difference to windows.

[agent006]

Right click on the 'My Computer' icon. do Properties, click the advanced tab. Then click startup and recovery. Then make sure that the automatically reboot box isn't checked.

If it's not a virus, it could be overheating.

[ErnestM]

mrflibbles said:

ErnestM said: Welchia methinks... Easy to verify. See if you have a winserver service running. Chances are - if you do it's welchia... ErnestM how do i do that then?

Actually - easier way...

See if you have a file named DLLHOST.EXE in your

WINNT slash WINS directory...

If you do, download the symantec Wlechia removal tool and run it...

ErnestM

[mrflibbles]

Wlechia worm found and destroyed

Hopefully it will be sorted now, but any advice on how to avoid these nastys in future?

Ive got a firewall, and have updated windows, but can anyone recommend and anti virus software, preferably thats free?

Should i stop p2p file sharing? i like free music

[plotloss]

No need to stop the P2P - in fact, get Soulseek - much better for music than Kazaa. www.slsk.org

For a free virus checker try here: www.grisoft.com/us/us_dwnl_free.php

[meeja]

mrflibbles said:

Wlechia worm found and destroyed Hopefully it will be sorted now, but any advice on how to avoid these nastys in future? Ive got a firewall, and have updated windows, but can anyone recommend and anti virus software, preferably thats free? Should i stop p2p file sharing? i like free music

Run windows update regularly (say once a week)

Don't know of any decent free AV software.... I use McAfee 7.... doesn't cost that much and is excellent.

Whatever AV software you do use, make sure you udate it regularly (like once a week again!)

P2P file sharing = trouble!