Help needed - MSBLAST

Friday, August 15, 2003 by Stumpy | Discussion: WinCustomize Talk

Can anyone here help me, I seem to have contracted the MSBLAST virus, I have removed two virus from my computer, but still seem to have problems, like for the last 2 days I cannot connect to the Stardock Chat Room and MSBLAST seems to be trying to do something like constantly trying to connect to internet. I only noticed this problem on Wednesday 13th August.

First - What is MSBLAST and can I remove it fron m my computer, if so how?

Second - Has anyone else had this problem and have you managed to eradicate the problem, if so please tell me how?





Powered by SkinBrowser!
14 Reply 1 Referrals
Chris
Reply #1 Friday, August 15, 2003 6:06 AM
Hi Stumpy

Stardocks's IRC server is down because of the massive power outage that has affected the north east over here.

MSBlast is worm that infects your computer when you're online. It takes advantage of a RPC buffer overrun flaw on XP. The worm installs MSBLAST.EXE in your windows system directory and adds itself to your registry's list of startup programs. I then crashes the RPC service, forcing the computer to reboot. You can kill the MSBlast.exe process running, delete it from the system directory, and search and remove it from the registry.

However, if you do so but install the patch that fixes the RPC overflow flaw, as soon as you get back on line, odds are you'll get infected with the worm again, which is the problem I had fixing a neighbor's computer. I had to download the patch from Microsoft's site on another computer because everytime I tried doing it on his, it would get re-infected and reboot before I had time downloading the patch.

Here's the link to Microsoft's patch for XP. You'll still have to remove MSBlast.exe from your system as the patch only corrects the RPC buffer overrun flaw.

http://www.microsoft.com/downloads/details.aspx?FamilyID=2354406c-c5b6-44ac-9532-3de40f69c074&displaylang=en

There is another thread somewhere on this board regarding the worm and a news item on the WC frontpage that probably has more information.

[Message Edited]
Stumpy
Reply #2 Friday, August 15, 2003 6:41 AM
Thanks Chris, that seems to have done thne trick, As I have not been online for a few days, I didn't realise that there was another thread regarding this problem. thanks again for the quick response.





Powered by SkinBrowser!
Weaksid
Reply #3 Friday, August 15, 2003 7:07 AM
Chris, I had to fix 2 computers already with that virus. It's nasty. It's even harder downloading the patch on a slow computer with a dialup connection. I should make a copy while I think about it for my tools.
MadDeez
Reply #4 Friday, August 15, 2003 7:33 AM
if the computer tries to reboot due to the msblast worm before you can get the thing fixed, in the 'run' box, type 'shutdown -a'. that will kill the shutdown process. also, if you don't turn off the system restore process before attempting to rid the system of the msblast worm, the system restore feature of XP will restore the system to use the msblast worm via the registry.
Koasati
Reply #5 Friday, August 15, 2003 7:35 AM
I got hit last night, while testing firewalls at GRC. (ironic, ain't it?) Trend Micro's PC-Cillin caught it instantly!
Koasati loves PC-Cillin.



Powered by SkinBrowser!
Weaksid
Reply #6 Friday, August 15, 2003 7:43 AM
Yea, alot of the virus scanners have the definition now. So hopefully the worm dies soon. Unless those people that don't know what a firewall and anti-virus is keep spreading it. But there are plenty free ones out there.
eieio
Reply #7 Friday, August 15, 2003 7:50 AM
Here's a good tool for removing the worm. You'll need to still run the patch but this is a good way to make sure all traces of the worm are gone

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

kona0197
Reply #8 Friday, August 15, 2003 7:55 AM
good thing I am running ME. no worms today thank you!
yrag2
Reply #9 Friday, August 15, 2003 9:03 AM
This http://www.microsoft.com/security/incident/blast.asp for the patch might be easier for those with dial-ups........



Powered by SkinBrowser!
Weaksid
Reply #10 Friday, August 15, 2003 9:41 AM
I'm going to download that fix from symantec and putting the update on a small CD-R I have. I like the micro CDs, they are good for things like this.
eieio
Reply #11 Friday, August 15, 2003 11:07 AM
#10 by Skinner Weaksid - 8/15/2003 9:41:33 AM I'm going to download that fix from symantec and putting the update on a small CD-R I have. I like the micro CDs, they are good for things like this.


That's what I did, Weaksid. Already used it and will probably continue to use it for a while, yet. Lot's of people with no firewall and/or antivirus software out there.
MadDeez
Reply #12 Friday, August 15, 2003 11:37 AM
or you can always go into msconfig and disable the worm from running there. after doing that, reboot the system and the worm won't shutdown the system on you while you're doing the removal. it works. i just did it on 3 machines this morning. just be sure to turn off system restore before removing the worm.
SelfExiled
Reply #13 Friday, August 15, 2003 1:02 PM
I understand exactly what Weaksid means. I couldn't believe how many people were dropping off at IRc chat with Virii and simple boot attacks. People just don't seem to understand how dangerous the internet is. Hopefully, they are just starters and don't use their computers for really important work.

Luckily, these Viruses don't mutate on their own like real life viruses. Oops, I shouldn't have said that. Some shmuck will probably creat one that does just that.

I've tried many firewalls and anti-virus programs. I think Norton Internet Security Professional is the best. Better than Zone Alarm Pro, which comes a not so close second. Because, NIS Pro comes with Anti Virus built in(NAV) and loads of other stuff too.
kona0197
Reply #14 Friday, August 15, 2003 10:38 PM
http://www.msn.com/Blaster/msblaster.htm

Please login to comment and/or vote for this skin.

Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:

  • Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
  • Access to a great community, with a massive database of many, many areas of interest.
  • Access to contests & subscription offers like exclusive emails.
  • It's simple, and FREE!
Login

Home | About | Privacy | Upload Guidelines | Terms of Service | Help
Copyright © Stardock Corporation. All Rights Reserved.


web-wc01