|
-
August 12th, 2003, 12:36 AM
#1
The Remote Procedure Call shutdown and msblast.exe
This has been going pretty strong today and may get worse before it gets better.
http://www.trendmicro.com/vinfo/viru...WORM_MSBLAST.A
Here is the manual removal information from the link:
Terminating the Malware Program
This procedure terminates the running malware process from memory.
1. Open Windows Task Manager press
CTRL+SHIFT+ESC, and click the Processes tab.
2. In the list of running programs*, locate the process:
MSBLAST.EXE
3. Select the malware process, then press either the the End Process button. (usually msblast.exe)
4. To check if the malware process has been terminated, close Task Manager, and then open it again.
5. Close Task Manager.
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing during startup.
1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
2. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
”windows auto update" = MSBLAST.EXE
4. Close Registry Editor.
You need to apply the patch from Microsoft to prevent the buffer overflow that allows the virus into your system through DCOM. For XP users like me, the download is at this link:
http://download.microsoft.com/downlo...80-x86-ENU.exe
and the page with the details for XP users that link is located on:
http://microsoft.com/downloads/detai...displaylang=en
Here is Microsoft's general information page about this DCOM buffer overflow issue and the patches:
http://support.microsoft.com/default...b;en-us;823980
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|