Member Avatar for Pitufo

Hi, not sure if anyone can help but I've encountered 2 problems using messenger. No problems on my side of things but 2 out of the 3 people I've tried connecting to with my webcam only get a black screen whereas it appears to be working on my end. NOTE: We overcame this problem by using web conference instead of just the webcam setting. Just curious about that...

#2: This is a little more serious: I've been trying to connect with my gf in Japan. Her computer is running Xp but I don't think she's installed the windows updates. There's also something running on her computer called "PCGATE" as far as I could find on the net it's some package developped by Norton. I'm assuming it's her firewall so once I got her to deactivate it we were able to connect. But after so long, her computer reboots itself. That's ok we figured it's just the PCGATE turning back on. Anyways we were able to connect on two separate occaisions but now all of a sudden she isn't able to connect to the internet at all. The error message she gets goes something like "True Vector internet" or something.

I just thought I'd throw this out here just on the off chance someone else has had experiences like this before, I know I'm not able to provide very detailed information about her computer (It's all in Japanese!) Thx for any help.

  • 4 Contributors
  • 9 Replies
  • 342 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by Pitufo

Dani AI

Generated

Short summary and a practical plan (builds on , , and ):

The "countdown" reboot symptom strongly points to the Blaster family (MSBlast / Lovesan) exploiting the RPC/DCOM hole fixed in MS03-026; that worm (and variants) will force reboots and can leave machines unstable. (learn.microsoft.com)

Do this in order (prioritize isolation and safety)

  • Immediately disconnect the infected PC from the network (unplug Ethernet / disable Wi‑Fi). That stops further spread and prevents re-infection while you work.
  • Boot the machine into Safe Mode (or use rescue media on another clean PC to make tools). If System Properties closes when clicked, disable System Restore via the registry so old restore points (likely infected) are removed: set the DWORD DisableSR = 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore, reboot, then proceed with cleaning. (Editing the registry is risky; back up the registry or follow this only if comfortable.) (learn.microsoft.com)

Cleaning, verification and patching

  • From a clean computer download current removal tools or a trusted rescue ISO from a major vendor, copy them to removable media, then run full offline scans on the infected PC in Safe Mode. After removal, make sure the MS03-026 fix (and any superseding updates) is applied before reconnecting to the Internet. Check the Run key (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) for entries like "windows auto update" pointing to msblast.exe and remove them if present. (learn.microsoft.com)

Extra notes and followups

  • Multiple worms (Welchia/Nachi, Lovsan etc.) circulated together; Welchia tried to remove Blaster but caused its own problems — expect to see several artifacts and clean all of them. (f-secure.com)
  • Processes such as rsvp.exe can be legitimate (check path: %SystemRoot%\System32); dvpapi.exe is not a default Windows file and often comes from bundled AV components—verify file location and digital signature before assuming it is malicious. After cleaning, re-enable System Restore, install all Windows updates, and keep a single, properly configured firewall/AV.

If the machine is hard to repair, make a full backup of personal files (from Safe Mode or by attaching the drive to a clean PC) and consider a clean reinstall after confirming important data is safe.

Recommended Answers

All 9 Replies

Member Avatar for TallCool1

...now all of a sudden she isn't able to connect to the internet at all. The error message she gets goes something like "True Vector internet" or something.

True Vector is part of ZoneAlarm. Could she have had two firewalls running? That would explain part of the problem.

Member Avatar for Pitufo

Hmm I'll have to check on that... but even if she did she hasn't changed anything since we were able to connect. First she would disabled the PCGATE thing and then we would connect, and then after awhile she would get a message saying that the computer needs to reboot itself and it would start a countdown during which we were able to remain in contact. Then her computer would reboot. Today she just wasn't able to even connect to the internet at all and that's when she was getting the true vector message. Anyways, thanx for ur post. I'm aware this could be annoying as I can't provide very detailed info.

Member Avatar for TallCool1

...after a while she would get a message saying that the computer needs to reboot itself and it would start a countdown during which we were able to remain in contact. Then her computer would reboot.

Ahh... the dreaded "countdown" sounds like the Blaster worm. There are so many threads here on that subject, it's hard to pick one for starters, so I will paraphrase myself from an earlier post:

That's probably the MS Blaster worm in action. It used the useless open service RPC on XP to install itself and do its dirty deeds. You will have to take several steps to fix it.

1. Go to Symantec and download-and-run the latest version of FixBlast, a free stand-alone tool to remove this worm.

2. Go to the Gibson Research website. Download-and-run the program Shoot the Messenger. There are other tools there, also.

Note: both these tools will fit on one floppy, so you can download them at a friend's house or computer store.

3. Make sure that all her XP patches are up-to-date.

4. Come back here and do a search on "Blaster" for more details.

5. She will likely also have to delete her System Restore files, as those have probably also been infected.

Member Avatar for Pitufo

hmmm, thx for the heads-up! I got a question, well I got 2 questions:
I did a search for blaster on this board but I didn't know which post to look in so I'll just ask it here: Can my computer get infected with this worm by using messenger with her if my computer is all up to date? and #2: What are some good alternatives to messenger for videoconferencing? thx again I'll get her to look into it.

Member Avatar for PMB76

To give enough time to work with the MSBlaster bit, disable the RPC notify

To disable RPC Notification for your computer, follow the steps below:

1. Click the Start button, and then click Run.

2. In the Open box, type:

Services.msc

3. Click the OK button.
The Services window appears.

4. Scroll down the list of services and double-click the first Remote Procedure entry.
The Remote Procedure Call (RPC) Properties window appears.

5. Click the Recovery tab.

6. For each of the failure dropdowns, click to select Take No Action.

7. Click the OK button to apply the changes.

8. Exit the Services window by clicking the red X in the upper right corner of the window.

NOTE:

This step does not remove the virus nor patch the system.

The RPC Service Notification can be re-enabled after the recommended patches are installed to test for this vulnerability.

Member Avatar for Pitufo

Ok, she hasn't been able to fix her computer yet, but my computer is all up to date so the last time we were using messenger I got her to start the application sharing feature so I could see her desktop. The app share thing took forever to start working and we were never able to connect. THEN all of a sudden a bunch of IE boxes with "This page cannot be displayed" kept poppin up and I mean they kept poppin up all over the screen and I couldn't stop them. Yikes. So I disconnected and tried to reconnect my internet but I couldn't. It told me my connection was working but I kept getting a "This page cannot be displayed" and if I started Messenger it told me that I couldn't connect because of a firewall. I only use the Win xp firewall at the moment. Anyways 10 minutes later my service seems to be working fine but all those windows popping up has left me a little worried. If my computer is up to date then can I get viruses by connecting to an infected computer over MSMessenger? I did a virus scan and it didn't find anything, except for a 158MB file from a game which I'm assuming is an error. Any help would be appreciated. 2 other things: When this happened I noticed a process called rsvp.exe running that I've never seen before. Also there is a process called dvpapi.exe running and I don't know where I got that virus scanner from. Thx.

Member Avatar for Pitufo

OK! We found some viruses on her computer: msblast.exe. dllhost.exe were deleted and there are w32/lovsn worm and w32 nachi worm virus. But we forgot to turn off the system restore first and so I get her to go to turn it off but when she clicks on system in the control panel it opens for a second and then closes so she can't access system restore! What do you think is causing that?

Member Avatar for caperjack

do it in Safe mode !

Member Avatar for Pitufo

o ya....

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.