Remove items from Startup menu...

[Mark]

Hi all,
I was one of the lucky ones who got the msblast worm
yesterday. Here's my question: I ran Norton SystemWorks
and it removed the worm just fine but I still have an
entry in the startup menu (in msconfig) that
says 'msblast' Is there a program/utility that will allow
me to remove that entry without disturbing anything else?

Thanks,
Mark

 

[Patrick Pitre]

Open you task manager, go to the Process tab, and force quit msblast.exe.
Then, open your registry (Start - Run - Regedit).
Drill down to here:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

When you highlight the Run folder, notice the keys on the right. Find the
one named Windows Auto Update - with a data value of msblast.exe. Delete the
key (on the right).

Also, msblast drops a copy in your system32 folder (this is where the
registry entry is pointing to). Check there and remove msblast.exe if you
find it.

Install the patch (Microsoft MS03-026) to prevent further exploitation. Then
seriously consider getting a software or hardware firewall. XP has a built
in one that won't cost you a cent.

Here's a Microsoft paper on the issue (with links to the patch):
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
virus/alerts/msblaster.asp

Good Luck. Post back if you need any further help.

Patrick Pitre