Hey Greg,

It is a virus!


W32.Blaster.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html


Worm targets Windows flaw, patch site
http://www.siliconvalley.com/mld/siliconvalley/6511962.htm


Good luck,



------------------
Kevin Bachelder

Microsoft Certified Systems Engineer (MCSE) - Windows NT 4.0
Microsoft Certified Systems Administrator (MCSA) - Windows 2000
Citrix Certified Administrator (CCA)
CompTIA A+ Certified Computer Repair Technician (A+)


At 01:03 AM 8/12/2003, you wrote:
>Date:    Tue, 12 Aug 2003 07:06:45 +0800
>From:    Greg De Guzman <[log in to unmask]>
>Subject: Virus or what?
>
>I'm troubleshooting a friend's computer that started behaving erratically
>that shows a pop-up after about 5 minutes that says "windows is shutting
>down due to a ____ terminated process". The pop-up starts a timer within
>itself  after which the system re-starts. This process repeats itself
>ad-infinitum everytime the computer re-starts.
>
>I thought of peeking through the start-up list and see what the system was
>loading and looked for unfamiliar programs. One entry caught my attention,
>and it is "msblast.exe". I did a search from the computer's Start Menu for
>the "msblast.exe* and it found the ff:
>
>c:\Windows\System32\msblast.exe
>
>c:\windows\Prefetch\MSBLASTEXE-09FF84F2.pf
>
>Deactivating the "msblast.exe" from the Start-up List stopped the process.
>
>What are these files? Are these Virus Payloads? Nothing was detected through
>the Norton AV installed with a Virus Definition dated 6/27/03 after
>repeating the Scan.
>
>Thanks for any inputs.
>
>
>Greg

                Curious about the people moderating your
                   messages? Visit our staff web site:
                    http://freepctech.com/staff.shtml