puter question pls

[historian]

Neighbors puter has the blaster worm. I dont want to reformat if i can help it but the puter shuts down before even reaching windows. I have the blaster removal tool but it wont work in dos. I tried a boot disk then went back to a:\ with removal tool but it doesnt work either.
Any suggestions pls?
thank

[bemildred]

1. Boot in safe mode?

You push F8 in the boot screen IIRC.

[kaitykaity]

2. Check this out.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

We recommend that you block access to TCP port 4444 at the firewall level, and then block the following ports, if you do not use the following applications:


TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"

[bemildred]

4. This is good.

I usually just unplug the damn ISP connection
(modem, ethernet, whatever) until I am happy with
the network setup. No connection, no traffic.

[kaitykaity]

5. I like their stuff.

I had a worm called "FVProtect" a few weeks ago, and
Symantec told me all about it.

[Maine-i-acs]

3. If Safe Mode won't allow you to run it:

You can pull out the hard drive, install it as a slave in another machine, and then run the Blaster removal tool on the slave drive.

[TryingToWarnYou]

6. Dont reformat

Thats like using a nuke to kill an anthill.

Boot up normally, use Ctrl, Alt and Del to get into Task Manager. Find MSBLAST.EXE in the list of processes or running programs, then end task on it. This should stop the shut down process.

If you can get into DOS, and it sounds like you can, use FPROT for DOS which is a superb AV program. Get it here:

http://www.f-prot.com/download/download_fpdos.html

Its also free for personal use.