|
|
OT virus
a new nasty virus started today and you dont even have to open an attachment to get it :( open windows "task manager" and see if "msblast.exe" is there, your infected if it is. most virus scanners cant find it because its so new :( also, if you know how to use regedit kill these HKLM/software/microsoft/windows/current ver/run windowsupdate/msblast.exe system32/msblast.exe MS fix is here for Win2000 http://microsoft.com/downloads/detai...displaylang=en info here http://isc.sans.org/diary.html?date=2003-08-11 or http://www.trendmicro.com/vinfo/viru...WORM_MSBLAST.A -- http://www.kencofish.com Ken Arnold, 401-781-9642 cell 401-225-0556 Importer/Exporter of Goldfish,Koi,rare Predators Shipping to legal states/countries only! Permalon liners, Oase & Supreme Pondmaster pumps Please Note: No trees or animals were harmed in the sending of this contaminant free message We do concede that a signicant number of electrons may have been inconvenienced ;) |
OT virus
I've got it.
Can you tell me more specifics on how to get rid of it? In laymans terms? I'm going to follow your link & try to learn. "KenCo" wrote in message ... a new nasty virus started today and you dont even have to open an attachment to get it :( open windows "task manager" and see if "msblast.exe" is there, your infected if it is. most virus scanners cant find it because its so new :( also, if you know how to use regedit kill these HKLM/software/microsoft/windows/current ver/run windowsupdate/msblast.exe system32/msblast.exe MS fix is here for Win2000 http://microsoft.com/downloads/detai...F541-4C15-8C9F -220354449117&displaylang=en info here http://isc.sans.org/diary.html?date=2003-08-11 or http://www.trendmicro.com/vinfo/viru...e=WORM_MSBLAST ..A -- http://www.kencofish.com Ken Arnold, 401-781-9642 cell 401-225-0556 Importer/Exporter of Goldfish,Koi,rare Predators Shipping to legal states/countries only! Permalon liners, Oase & Supreme Pondmaster pumps Please Note: No trees or animals were harmed in the sending of this contaminant free message We do concede that a signicant number of electrons may have been inconvenienced ;) |
OT virus
This appears to be a variation on an old hoax. Ms Blast.exe appears to
be a legit file. This virus does not show up on Symantic's list. There is an MSBlaster worm which willl exploit the existing and legit Msblast.exe file. I don't knwo what Msblast does, I would not remove it. |
OT virus
Symantec's response to the virus msblaster is here
http://www.symantec.com/avcenter/ven...ster.worm.html |
OT virus
|
OT virus/NOT A HOAX
"danrahan" wrote in message ... This appears to be a variation on an old hoax. Ms Blast.exe appears to be a legit file. This virus does not show up on Symantic's list. I just received a warning from my antivirus program (E-Trust) warning me of the virus, along with a full report of how it works. NO HOAX. Update your antivirus NOW. Here is a snippet of what E-Trust sent me this morning: *********************************************** Win32.Poza is a worm using the exploit described in MS03-026 to gain access to unpatched Windows installation. More information about the exploit can be found in our Vulnerabilities Library or at the Microsoft site he http://www.microsoft.com/technet/sec...n/MS03-026.asp Method of Installation It creates a mutex "BILLY" to avoid running multiple instances of itself, and creates a registry value to activate on Windows restart: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wind ows auto update = "msblast.exe" The worm runs a FTP service listening on port 69 waiting for exploited machine to connect. Method of Distribution It starts by scanning the entire subnet for open 135 ports, then moves on to scan randomly selected class B subnets (255.255.0.0) to start scanning. If an open 135 port is found, it uses the exploit mentioned above to gain entry and create a remote shell on the exploited machine. It then assumes the exploit succeeded and attempts to connect to port 4444 of the remote machine. If successfully connected, it instructs the remote machine to download MSBLAST.EXE (size: 6,176 bytes, UPX packed) from its FTP service using TFTP.EXE. It then sends an instruction to start MSBLAST.EXE on the remote machine. Note: TFTP.EXE is an utility included by default in Windows installation of Windows 2000 and later versions. The worm is capable of keeping live connections to 20 exploited machines simultaneously. Payload If the day of the month is 16 or later, or the month is between January and August, the worm creates a working thread to send random data to windowsupdate.com almost continuously. This effectively launches a Distributed Denial of Service attack against windowsupdate.com. Additional Information The worm body contains these strings: I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!! CA has also received reports from several sources that this worm may be seen, associated with crashes of svchost.exe. ************************************************** ** |
OT virus
I've got it. Can you tell me more specifics on how to get rid of it? In laymans terms? I'm going to follow your link & try to learn. W32.Blast is a worm. Virus Information Center Win32.Poza Alias: DcomRPC.exploit, W32.Blaster.Worm (Symantec) , W32/Lovsan.worm (McAfee), W32/Msblast.A (F-Secure) , Win32/Poza.Worm , WORM_MSBLAST.A (Trend) Category: Win32 Type: Worm Published Date: 8/11/2003 Last Modified: 8/11/2003 Download ClnPoza.zip he http://www3.ca.com/virusinfo/virus.aspx?ID=36265 |
OT virus
There is an MSBlaster worm which willl exploit the existing and legit Msblast.exe file. W32.Blast is a worm. Virus Information Center Win32.Poza Alias: DcomRPC.exploit, W32.Blaster.Worm (Symantec) , W32/Lovsan.worm (McAfee), W32/Msblast.A (F-Secure) , Win32/Poza.Worm , WORM_MSBLAST.A (Trend) Category: Win32 Type: Worm Published Date: 8/11/2003 Last Modified: 8/11/2003 Download ClnPoza.zip he http://www3.ca.com/virusinfo/virus.aspx?ID=36265 I don't knwo what Msblast does, I would not remove it. It will keep throwing up error messages and reboots your computer, monotonously(sp?) as long as your modem is running. |
OT virus
This program continually shuts your computer down when you are trying to get
the update patch....an easy way to get around this is to DL ZoneAlarm which will allow you get get the files you need. ZoneAlarm detected and blocked over 100 alerts in a 3 hour period this morning.....this is a nasty one. KenCo wrote in message ... a new nasty virus started today and you dont even have to open an attachment to get it :( open windows "task manager" and see if "msblast.exe" is there, your infected if it is. most virus scanners cant find it because its so new :( also, if you know how to use regedit kill these HKLM/software/microsoft/windows/current ver/run windowsupdate/msblast.exe system32/msblast.exe MS fix is here for Win2000 http://microsoft.com/downloads/detai...F541-4C15-8C9F -220354449117&displaylang=en info here http://isc.sans.org/diary.html?date=2003-08-11 or http://www.trendmicro.com/vinfo/viru...e=WORM_MSBLAST ..A -- http://www.kencofish.com Ken Arnold, 401-781-9642 cell 401-225-0556 Importer/Exporter of Goldfish,Koi,rare Predators Shipping to legal states/countries only! Permalon liners, Oase & Supreme Pondmaster pumps Please Note: No trees or animals were harmed in the sending of this contaminant free message We do concede that a signicant number of electrons may have been inconvenienced ;) |
OT virus
Wilson wrote:
This program continually shuts your computer down when you are trying to get the update patch....an easy way to get around this is to DL ZoneAlarm which will allow you get get the files you need. ZoneAlarm detected and blocked over 100 alerts in a 3 hour period this morning.....this is a nasty one. luckily its just annoying and not renaming files like some of the other viruses. -- http://www.kencofish.com Ken Arnold, 401-781-9642 cell 401-225-0556 Importer/Exporter of Goldfish,Koi,rare Predators Shipping to legal states/countries only! Permalon liners, Oase & Supreme Pondmaster pumps Please Note: No trees or animals were harmed in the sending of this contaminant free message We do concede that a signicant number of electrons may have been inconvenienced ;) |
| All times are GMT +1. The time now is 03:00 PM. |
Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
FishKeepingBanter.com