My DH has a computer repair business, his phones are ringing off the hook.
It''s going around virus dectectors.
"KenCo" wrote in message
...



a new nasty virus started today and you dont
even have to open an attachment to get it

open windows "task manager" and see if "msblast.exe" is there,
your infected if it is.

most virus scanners cant find it because its so new

also, if you know how to use regedit
kill these
HKLM/software/microsoft/windows/current ver/run
windowsupdate/msblast.exe
system32/msblast.exe

MS fix is here for Win2000

http://microsoft.com/downloads/detai...F541-4C15-8C9F
-220354449117&displaylang=en

info here
http://isc.sans.org/diary.html?date=2003-08-11
or

http://www.trendmicro.com/vinfo/viru...e=WORM_MSBLAST
..A


--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

FBCS wrote:

My DH has a computer repair business, his phones are ringing off the hook.
It''s going around virus dectectors.


and this virus is only 1 day old

all the antivirus websites have the fix for it now.

--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

FBCS wrote:

My DH has a computer repair business, his phones are ringing off the hook.
It''s going around virus dectectors.


and this virus is only 1 day old

all the antivirus websites have the fix for it now.

--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

FBCS wrote:

My DH has a computer repair business, his phones are ringing off the hook.
It''s going around virus dectectors.


and this virus is only 1 day old

all the antivirus websites have the fix for it now.

--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

FBCS wrote:

My DH has a computer repair business, his phones are ringing off the hook.
It''s going around virus dectectors.


and this virus is only 1 day old

all the antivirus websites have the fix for it now.

--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

Thanks Ken for posting this OT thread, and to all the rest who supplied info
& links.
I had been having the mysterious system shutdown for a couple days.
I downloaded MS's patch, & Symantec's tool, after several attempts due to
worm re-boots.
The worm is now dead.
I fed it to my fish ;-))
David


"KenCo" wrote in message
...



a new nasty virus started today and you dont
even have to open an attachment to get it

I have Windows 98. I understand that this virus infects only
Windows 2000 and XP versions. Is this true?

Nedra
http://www.geocities.com/Heartland/Pines/4836
http://community.webshots.com/user/nedra118
"KenCo" wrote in message
...
Wilson wrote:

This program continually shuts your computer down when you are trying to
get
the update patch....an easy way to get around this is to DL ZoneAlarm
which
will allow you get get the files you need. ZoneAlarm detected and
blocked
over 100 alerts in a 3 hour period this morning.....this is a nasty one.



luckily its just annoying and not renaming files like
some of the other viruses.




--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

Let me know tomorrow if you are still having problems Kelly, I'll send you
ZA and the worm cleanup program on disk or floppy if you need it. Just
answer me back in this same thread if you want them. Or anyone else for
that matter....I would be happy to help out.

Wilson


Unfortunately, one of the effects of this bug is that it can
crash/reboot your system before you're able to download ZA, or an
update to your virus cleaning software, etc. (This prevented me from
being able to fix my system last night.)

I found this standalone blaster remover from Symantec. It's small
enough I should be able to download it before my system reboots, so
hopefully this will work:

"FBCS" wrote in message
...
My DH has a computer repair business, his phones are ringing off the hook.
It''s going around virus dectectors.


It's not going around Zone Alarm though...my work computer had it on and
blocked well over 200 port scans last night and today, it's a must have.

"Kelly E Jones" wrote in message
...
In article ,
Wilson wrote:

Unfortunately, one of the effects of this bug is that it can
crash/reboot your system before you're able to download ZA, or an
update to your virus cleaning software, etc. (This prevented me from
being able to fix my system last night.)

I found this standalone blaster remover from Symantec. It's small
enough I should be able to download it before my system reboots, so
hopefully this will work:



http://securityresponse.symantec.com...laster.worm.re
m
oval.tool.html

Kelly

One thing that you MUST have on your computer besides Zone Alarm is
Download
Accelerator with resume supported

Yes, I thought of this as well. Unfortunately, I didn't have it yet,
and I couldn't download it because of the da*n worm! (My computer is
relatively new, and I haven't had a chance yet to download ZA, or a
download manager, or update my virus defs, etc. I'll be doing all
that as soon as get the system cleaned up.)

FWIW, if one does the Ctrl/Alt/Delete thing to bring up the Windows Task
Manager, under the "Processes" tab, click the Image Name (gray box), scroll
down to msblast.exe, click to highlight it, then click the "end process"
box. Close that out and go into regedit, like you said earlier, and delete
the entry (using the path you stated)..........one can then get on the
internet without being booted by the worm (using a phone line modem). I
repaired my broadband connection _first_, though. Then downloaded the new
virus definitions and the repair tool from Symantec. Ran the repair tool
(supposed to run it twice), then downloaded the MS patch.

Nedra wrote:

I have Windows 98. I understand that this virus infects only
Windows 2000 and XP versions. Is this true?

Nedra
http://www.geocities.com/Heartland/Pines/4836
http://community.webshots.com/user/nedra118
"KenCo" wrote in message
...


its not supposed to hit 98 BUT try to get the latest
service pack for 98 at microsoft.com

--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

"Nedra" wrote in message
link.net...
I have Windows 98. I understand that this virus infects only
Windows 2000 and XP versions. Is this true?


That is correct.


Nedra
http://www.geocities.com/Heartland/Pines/4836
http://community.webshots.com/user/nedra118
"KenCo" wrote in message
...
Wilson wrote:

This program continually shuts your computer down when you are trying
to
get
the update patch....an easy way to get around this is to DL ZoneAlarm
which
will allow you get get the files you need. ZoneAlarm detected and
blocked
over 100 alerts in a 3 hour period this morning.....this is a nasty
one.



luckily its just annoying and not renaming files like
some of the other viruses.




--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced

"volts500" wrote in message
om...

"Kelly E Jones" wrote in message
...
In article ,
Wilson wrote:

Unfortunately, one of the effects of this bug is that it can
crash/reboot your system before you're able to download ZA, or an
update to your virus cleaning software, etc. (This prevented me from
being able to fix my system last night.)

I found this standalone blaster remover from Symantec. It's small
enough I should be able to download it before my system reboots, so
hopefully this will work:




http://securityresponse.symantec.com...laster.worm.re
m
oval.tool.html

Kelly

One thing that you MUST have on your computer besides Zone Alarm is
Download
Accelerator with resume supported

Yes, I thought of this as well. Unfortunately, I didn't have it yet,
and I couldn't download it because of the da*n worm! (My computer is
relatively new, and I haven't had a chance yet to download ZA, or a
download manager, or update my virus defs, etc. I'll be doing all
that as soon as get the system cleaned up.)

FWIW, if one does the Ctrl/Alt/Delete thing to bring up the Windows Task
Manager, under the "Processes" tab, click the Image Name (gray box),
scroll
down to msblast.exe, click to highlight it, then click the "end process"
box. Close that out and go into regedit, like you said earlier, and
delete
the entry (using the path you stated)..........one can then get on the
internet without being booted by the worm (using a phone line modem). I
repaired my broadband connection _first_, though. Then downloaded the new
virus definitions and the repair tool from Symantec. Ran the repair tool
(supposed to run it twice), then downloaded the MS patch.

Sorry, like KenCo said, the regedit path is:

KenCo wrote:
"also, if you know how to use regedit
kill these
HKLM/software/microsoft/windows/current ver/run
windowsupdate/msblast.exe
system32/msblast.exe"

"Kelly E Jones" wrote in message
...
In article ,
Wilson wrote:

Unfortunately, one of the effects of this bug is that it can
crash/reboot your system before you're able to download ZA, or an
update to your virus cleaning software, etc. (This prevented me from
being able to fix my system last night.)

I found this standalone blaster remover from Symantec. It's small
enough I should be able to download it before my system reboots, so
hopefully this will work:



http://securityresponse.symantec.com...laster.worm.re
m
oval.tool.html

Kelly

One thing that you MUST have on your computer besides Zone Alarm is
Download
Accelerator with resume supported

Yes, I thought of this as well. Unfortunately, I didn't have it yet,
and I couldn't download it because of the da*n worm! (My computer is
relatively new, and I haven't had a chance yet to download ZA, or a
download manager, or update my virus defs, etc. I'll be doing all
that as soon as get the system cleaned up.)

FWIW, if one does the Ctrl/Alt/Delete thing to bring up the Windows Task
Manager, under the "Processes" tab, click the Image Name (gray box), scroll
down to msblast.exe, click to highlight it, then click the "end process"
box. Close that out and go into regedit, like you said earlier, and delete
the entry (using the path you stated)..........one can then get on the
internet without being booted by the worm (using a phone line modem). I
repaired my broadband connection _first_, though. Then downloaded the new
virus definitions and the repair tool from Symantec. Ran the repair tool
(supposed to run it twice), then downloaded the MS patch.

Nedra wrote:

I have Windows 98. I understand that this virus infects only
Windows 2000 and XP versions. Is this true?

Nedra
http://www.geocities.com/Heartland/Pines/4836
http://community.webshots.com/user/nedra118
"KenCo" wrote in message
...


its not supposed to hit 98 BUT try to get the latest
service pack for 98 at microsoft.com

--
http://www.kencofish.com Ken Arnold,
401-781-9642 cell 401-225-0556
Importer/Exporter of Goldfish,Koi,rare Predators
Shipping to legal states/countries only!
Permalon liners, Oase & Supreme Pondmaster pumps


Please Note: No trees or animals were harmed in the
sending of this contaminant free message We do concede
that a signicant number of electrons may have been
inconvenienced