Remote Procedure Call?

[dreamtfk]

Hmm I just checked and there is no such key in my registry.

 

[thefly]

Here are the registry keys according to nai.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "windows auto update" = msblast.exe I just want to say LOVE YOU SAN!! bill

This will appear in regedit as:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "windows auto update" = msblast.exe

Or you can search the registry with the registry searching tool to see if it's hiding somewhere else.

I bet we'll be seeing an more destructive variation pretty soon.

Patch & clean your machine and get a firewall program.

Running broadband sans firewall is pretty dangerous these days.

Sygate personal firewall is a really nice little program that doesn't use up too much sys resources.

www.sygate.com

 

[madcow235]

i think its "shutdown -a" to abort the shutdown caused by this

 

[T20]

its "Shutdown /a"

 

[seren]

Go here and on the forst page there is a tool that remowves the virus and sorts the regitery it all there and it's easy it must be I did it

http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[IceMan3928]

I'm curious how it gets in too, I think I read its a email attachment but, after my new install/format I had'nt recieved any when I noticed it.

I guess my windows version would have been full of the unpatched security issues at that time though.

C

Its not an email attachment or anything near so clumsy (the really sad thing is that those kinds of viruses actually spread), this one uses an algorithm to generate random IPs based of the infected computers IP, it then opens a connection to those IPs and sends itself to them.

 

[Serville]

Now I got confused.
I just recently got this problem as well about 4-5 days ago.
But then there is no such thing like MSBLAST.exe in any directory. No startup registry. I even search for "msblast" in the registry and it's not anywhere. How about that ?
What could be the problem ?

One thing I notice : if I enable XP Firewall, the problem disappears

 

[T20]

It could already have been removed. Just restart, press CTR-SHIFT-ESC, see if MSBLAST is running in one of the processes. If not, then you dont have it.