Re: [Dev-C++] virus help!!

[Andres R. <lo...@ho...>]

Hello!

To remove msblast disconnect from net, kill it on taskman, then delete msbl=
ast.exe and then
remove reg_key in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
_windows auto update" =3D MSBLAST.EXE

Try using some kind of firewall and denay trafic on port nr. 135 (M$ sugges=
t also to denay trafic on port 139 and 445).

Then try to make a windows update if you have'nt it recently. Accoring to m=
$ timestamps, patch for RPC Buffer Overflow (virus exploits that "feature")=
 has been available since 16 july.

MSBLAST affects only NT based systems. 9x systems seems to be
unaffected.

Using firewall I got 21 trafic notifications on port 135 in 20 minutes,
so... it's spreading pretty wildly imho!

HTH

Andres


On Mon, 11 Aug 2003 22:39:59 +0200
OROSZI Bal_zs <or...@vp...> wrote:

> Hi!
>=20
> Whatever you try to do to wipe this virus out, always keep it in mind,=20
> that some viruses like to take revenge on the person, who tries to=20
> remove them. They do it by placing themselves to different and lots of=20
> places, and if one of them is removed, then the rest will format your=20
> hard drive (or something bad). See your startup settings. Run msconfig,=20
> and see if there is anything suspicious there.
>=20
> That's all I can tell you know, I'll try to look for something about=20
> this on the Net.
>=20
> --
> Greetings,
>    Bal_zs
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/=
01
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users