msblast

[Janet]

After my computer was infected with the blaster worm, I
was still having problems so a tech rep with HP had me
looking at the configuration manager. I read off the
entries, and when I read "msblast", he had me uncheck
it. I did run Microsoft's updates that were supposed to
remove this, but it remains. The entry in the msconfig
files is: item: msblast command: msblast.exe
location: SOFTWARE\microsoft\Windows\Current Version\Run
Since all of the other items on the list, command starts
with C:, I don't know where this is stored. I've tried
to use the find option to locate it, but find does not
locate any file or folder with the name "msblast". Can
you tell me where to look for it?

 

[John Thomas Smith]

After my computer was infected with the blaster worm, I
was still having problems so a tech rep with HP had me
looking at the configuration manager. I read off the
entries, and when I read "msblast", he had me uncheck
it. I did run Microsoft's updates that were supposed to
remove this, but it remains. The entry in the msconfig

You might try the appropriate removal tool here
http://securityresponse.symantec.com/avcenter/tools.list.html


John Thomas Smith
http://www.direct2usales.com
http://www.pacifier.com/~jtsmith

 

[Will Denny]

Hi

Have you tried this article:

"Virus Alert About the Blaster Worm and Its Variants"
http://support.microsoft.com/default.aspx?scid=kb;en-us;826955

--

Will Denny
MS-MVP Windows - Shell/User
Please reply to the News Groups


| After my computer was infected with the blaster worm, I
| was still having problems so a tech rep with HP had me
| looking at the configuration manager. I read off the
| entries, and when I read "msblast", he had me uncheck
| it. I did run Microsoft's updates that were supposed to
| remove this, but it remains. The entry in the msconfig
| files is: item: msblast command: msblast.exe
| location: SOFTWARE\microsoft\Windows\Current Version\Run
| Since all of the other items on the list, command starts
| with C:, I don't know where this is stored. I've tried
| to use the find option to locate it, but find does not
| locate any file or folder with the name "msblast". Can
| you tell me where to look for it?
|
|

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB828471 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

MS04-012 Cumulative Update for Microsoft RPC-DCOM
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[Joe 1]

The msconfig entry sounds like an item in the registry.
Unless you have knowledge and experience in registry
backup and editing, I would look for an msblaster removal
tool using a search engine on the internet. A mistake in
editing the registry could make a very expensive door stop
out of the PC.