From: owner-seven-seas@smoe.org (seven-seas-digest) To: seven-seas-digest@smoe.org Subject: seven-seas-digest V2 #646 Reply-To: seven-seas@smoe.org Sender: owner-seven-seas@smoe.org Errors-To: owner-seven-seas@smoe.org Precedence: bulk seven-seas-digest Tuesday, August 12 2003 Volume 02 : Number 646 ---------------------------------------------------------------------- Date: Tue, 12 Aug 2003 22:03:49 +0100 From: "Matt H" Subject: Re: seven-seas VIRUS alert Can I ask what this thing actually does, or is supposed to do? I ask because my PC is only 12 months old, running Windows XP. I have Zone Alarm Pro firewall (and there ain't no way I'm turning it off, so you'll probably get this twice), and I haven't noticed my PC doing anything it shouldn't, or not doing something it should. Echo and the Bunnymen | the official website: http://www.bunnymen.com ___________________________________________________________ Get your own Web-based E-mail Service at http://www.zzn.com ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ Date: Tue, 12 Aug 2003 22:03:49 +0100 From: "Matt H" Subject: Re: seven-seas VIRUS alert Can I ask what this thing actually does, or is supposed to do? I ask because my PC is only 12 months old, running Windows XP. I have Zone Alarm Pro firewall (and there ain't no way I'm turning it off, so you'll probably get this twice), and I haven't noticed my PC doing anything it shouldn't, or not doing something it should. Echo and the Bunnymen | the official website: http://www.bunnymen.com ___________________________________________________________ Get your own Web-based E-mail Service at http://www.zzn.com ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ Date: Tue, 12 Aug 2003 22:09:16 +0100 From: "Matt H" Subject: Re: seven-seas VIRUS alert >I know a few on here use grisoft.. there is an update to counter >this virus available just by updating your database in the usual >way.. Well reminded....I hadn't updated, but have now.... Echo and the Bunnymen | the official website: http://www.bunnymen.com ___________________________________________________________ Get your own Web-based E-mail Service at http://www.zzn.com ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ Date: Tue, 12 Aug 2003 22:09:16 +0100 From: "Matt H" Subject: Re: seven-seas VIRUS alert >I know a few on here use grisoft.. there is an update to counter >this virus available just by updating your database in the usual >way.. Well reminded....I hadn't updated, but have now.... Echo and the Bunnymen | the official website: http://www.bunnymen.com ___________________________________________________________ Get your own Web-based E-mail Service at http://www.zzn.com ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ Date: Tue, 12 Aug 2003 16:15:34 -0500 From: Amy Moseley Rupp Subject: Re: seven-seas VIRUS alert Quoting Matt H : > Can I ask what this thing actually does, or is supposed to do? > > I ask because my PC is only 12 months old, running Windows XP. I > have Zone Alarm Pro firewall (and there ain't no way I'm turning it > off, so you'll probably get this twice), and I haven't noticed my PC > doing anything it shouldn't, or not doing something it should. You might not notice anything. The worm uses a hole in the file transfer mechanism to force a copy of itself onto your machine. Check your firewall -- do you have port 135 enabled? If so, you might already have the virus. Disable ports 135 and 4444. Once installed, the virus will then try to randomly infect other machines on the Net, causing you to see some degradation in performance. Your computer can crash, and probably will, because of Yet Another Stupid incompatibility issue trying to transfer the file from your computer to 2000 computers. XP computers are the most highly targeted. Make sure to install the latest Windows updates, and if you have virus inspection software, look for upgrades and install it. Other things: if you look at Task Manager and see "msblast.exe" running, you've got the virus; and if you find the file of that name on the system, you've got it. It also installs a registry key. I suppose you could turn your computer off on the 16th since that's when the big fireworks will begin; but the minute you turn it back on, it'd start flooding the Microsoft web site with bogus requests for their web page. - ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ Date: Tue, 12 Aug 2003 16:20:53 -0500 From: Amy Moseley Rupp Subject: Re: Re: seven-seas VIRUS alert -- Windows -- everyone affected; see cnn.com > I know a few on here use grisoft.. there is an update to counter this virus > available just by updating your database in the usual way.. Even with the virus update, you still must install the Windows update. The hassle with this virus is that it's highly transmissible and whilst you'd be completely protected if you'd installed the latest Windows update, most haven't, and then you have to go through a very lengthy removal process. After you've patched and updated, ensure that "msblast.exe" is not currently executing; that a file of that name is not on your system; and that there isn't a registry key called: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run with a value of "windows auto update"="msblast.exe" To check the registry, open a DOS shell (aka command prompt) and type "regedit". The various virus checkers *may* do all of the above for you, but I wouldn't count on it. - ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ Date: Tue, 12 Aug 2003 22:22:06 +0100 From: "Matt H" Subject: Re: seven-seas VIRUS alert >if you look at Task Manager and see "msblast.exe" running, >you've got the virus; and if you find the file of that name >on the system, you've got it. Nothing found, but hey....there's time i suppose. Echo and the Bunnymen | the official website: http://www.bunnymen.com ___________________________________________________________ Get your own Web-based E-mail Service at http://www.zzn.com ====================================== http://www.bunnymenlist.com ====================================== ------------------------------ End of seven-seas-digest V2 #646 ********************************