I had an email from my ISP thid morning warning me of yet another virus, similar to MSBlast. It gives instructions on how to locate it and how to clear it, which involves downloading a patch from microsoft.com. The problem is that the virus keeps shutting my pc down spontaneously halfway through the damn download, grrrrrrrrr.
For those of you who want to check your systems here is the info sent to me in the email from my ISP....
Dear Customer
IMPORTANT INFORMATION REGARDING YOUR INTERNET ACCESS
You may remember that we wrote to you recently concerning a virus called MSBlast that was affecting Internet customers using the Windows 2000, NT and XP operating systems. Since we last wrote to you a new virus called .Welchia. has started to affect Internet customers using the same operating systems (it does not infect any other operating systems). One of the features of this new virus is slow browsing. This may already be affecting you and if not probably will do soon unless you have followed the steps below.
What if I am infected by one of these viruses?
It is essential that you check to see if you are affected by either of these viruses and to take steps to remove them from your machine and download some software from www.microsoft.com to protect your computer from future infections.
STEP 1 . DOWNLOAD THE MICROSOFT PATCH (IT IS VITAL YOU TAKE THIS STEP FIRST)
IF YOU HAVE ALREADY DONE THIS, PLEASE NOTE THAT A NEW PATCH WAS RELEASED ON 10 SEPTEMBER 2003. IT IS VITAL THAT YOU UPGRADE TO THIS PATCH EVEN IF YOU DOWNLOADED THE ORIGINAL PATCH.
You need to visit www.microsoft.com/downloads and download the .Blaster Critical Security Patch. for your Operating system.
Once you have completed this step, it will secure your machine against future infections from MSBlast and Welchia.
STEP 2 - IDENTIFYING IF YOU HAVE A VIRUS (IT IS VITAL YOU CHECK FOR ALL THE VIRUSES)
-
Hold down the CTRL +ALT+ DELETE keys all at the same time - A new window will appear on the screen.
-
Select the .PROCESSES. tab within the window by clicking on it once with your left mouse button . This should show you a list of processes that are currently running.
-
If the following processes are present in the list:
. DLLHOST.EXE
(If present this means it is possible your computer is infected with Welchia)
. SVCHOST.EXE
(If present this means it is possible your computer is infected with Welchia)
. MSBLAST.EXE
(If present this means your computer is infected with MSBlastA)
. PENIS32.EXE
(If present this means your computer is infected with MSBlastB)
. TEEKIDS.EXE
(If present this means your computer is infected with MSBlastC)
. MSLAUGH.EXE
(If present this means your computer is infected with MSBlastE)
. ENBIEI.EXE
(If present this means your computer is infected with MSBlastF)
STEP 3 . REMOVING THE VIRUSES
For MSBlast
To remove MSBlast, please visit the following link and follow the instructions on how to automatically remove the MSBlast virus:
securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
For Welchia
There is also a tool, which will automatically remove the Welchia virus from your computer. Please visit the following site and follow the instructions presented to you:
securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
Additional Information
The nature of these viruses means that unknowing to the user concerned, when they are browsing the Internet, they are sending out data to other users. Although this data does not give out any information regarding the infected customer to other Internet users, the fact that so much data is being sent out by so many customers had lead to a reduction in performance for customers using the Tesco.net network. You may well have been affected by such degradation in performance yourself.
What happens if I am infected by one of the viruses and take no action?
It only takes a relatively small number of infected customers to affect the performance of other Tesco.net customers. Therefore to ensure we continue to uphold our high levels of network performance, we will shortly be restricting Internet access to customers who are infected by these viruses. These customers will be .detained. in restricted area of the Internet which only gives them access to sites that enable them to disinfect their computer and download the software .patch. to prevent future infections. To ensure you are not restricted in such a manner, it is important that you take steps NOW.
What to do if you have not downloaded the Microsoft .patch..
If you have not downloaded the software patch from the Microsoft site, it is VERY important that you do so as soon as possible. To download and install the Microsoft patch, please follow the following instructions:
Additional Help
One of the effects of the viruses is that they can cause your machine to continually .re-boot. (that is constantly re-start). If you hare tried the above steps and found it difficult to stay connected to the Internet long enough, you can request a CD which contains a copy of the Microsoft patch by calling our free phone Service Announcement line on 0800 519 2345 and leaving your name and address.
Many thanks
Tesco.net Support Team