Undetected Worm...no one can fix?

[adrenaline68]

It appears I have a nasty worm/virus on my network here at my office. It started when I tried to open some Microsoft Office components (word and excel) and it brough up Microsoft Installer. I restarted, and same thing happed as it was launching Windows XP home edition. In fact I felt like it was mocking me because the first thingto come up after logging in was the McAfee window showing it was launching then over that pops up the windows installer. Well after a copuple minutes it gave me that system shutdown window and the 60 second counter that so many people are familair with. I stopped it by using the shutdown -a command but it screwed with alot of functions after that. After a bit I read up on the various worms and it just got more interesting from there. It sounded like msblaster or one of its modifications. The windows security patches for the worms wont install because I have the newest version already. The McAfee Virus Scan 8 doesnt pick anything up. I am running a large number of slqserver.exe instances when all this is happeneing. I tried to use stand alone programs such as stinger and the blastfix tool that are suppose to clean the problem. They all come up clean. I folowed instructions to clean the drive of the possible lsass.exe problem and it turned up nothing. At that point I found that my McAfee's last update didnt work and it returns an error when I try to update it manually. I looked in the registry keys where the worm/virus would have blocked the server and it was not there. As a last resort I ran through Microsoft's online threat detection program for worms...once again nothing. This one is a real ball buster and its confusing as all heck. Please help.

 

[Peddant]

Try the standard Techspot anti-malware routines -

https://www.techspot.com/vb/topic30213.html and https://www.techspot.com/vb/topic17297.html

then post an HJT log - https://www.techspot.com/vb/topic19133.html

It might provide some clues.

 

[Samstoned]

if you have the sasser virus sorry
lots of work ahead
fix