Outlook Express crashing system on shutdown.

Discussion in 'Computer Support' started by hugh jass, Aug 21, 2003.

  1. hugh jass

    hugh jass Guest

    I'm trying to help a friend over the phone with a computer problem.
    He tells me that when he shuts down Outlook Express, sometimes it initiates
    the os shutdown process. It doesn't give him an option and just goes ahead
    with shutdown. This has happened a few times, but not every time.
    He has also noticed that his dialup internet connection is getting slower
    all the time.
    Worried that he may have the Blaster virus, he asked me to send him some
    info on it.
    He went into Regedit as I advised, but instead of navigating to the location
    (...Run/WindowsAutoUpdate/), he
    did a Find on the msblast.exe file.
    Regedit found 'msblast.exe' in My
    Computer\HKEY_USERS\S-1-5-21-220523388-1060284298-1343024091\Identities\' in
    one of the identities. I advised that he delete it.
    Anyone know what it was doing here and if this could be one of the causes of
    his pain? It's not found in the usual location, where I found it on my
    system before.
    Anyone know if this behaviour is a virus? Any suggestions on what to do?
    Thanks much, hj.
    ______________________
    "peace - it's worth killing for"
    - Bush
    hugh jass, Aug 21, 2003
    #1
    1. Advertising

  2. hugh jass

    °Mike° Guest

    If that was, indeed, the registry key, then it's corrupt, and wouldn't
    point to a startup location, or even Outlook Express. I have a hunch
    that your information is suspect.

    Boot into Safe Mode and start the registry editor:
    Start / Run / regedit

    Navigate to:
    HKEY_LOCAL_MACHINE
    +Software
    +Microsoft
    +Windows
    +CurrentVersion
    +Run

    In the right-hand pane, look for any entry/ies that include
    MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
    DELETE it/them.
    These are the files associated with the different variants:
    Variant A - msblast.exe
    Variant B - penis32.exe
    Variant C - teekids.exe

    You just disabled the worm from running at startup, so boot into
    normal mode again, and turn off ALL system restores to purge
    your system.

    Open Windows Explorer to the ..\Windows\System32\ or
    ...\WinNT\System32\ folder and DELETE *any* of the
    files named above.

    Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
    and find the reference to the above file/s (any reference will
    be similar to: <filename.exe>-<alphanumerics>.PF), for example,
    msblast.exe-0235D8H6.pf, and DELETE it/them.

    Now you can download and install the patch, configure your
    firewall and update your virus scanner.

    Virus Alert About the Blaster Worm and Its Variants
    http://support.microsoft.com/search/preview.aspx?id=kb;en-us;826955

    Microsoft Security Bulletin MS03-026
    http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

    What you should know about the Blaster worm
    http://www.microsoft.com/security/incident/blast.asp

    Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
    http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

    How to Use The KB 823980 Scanning Tool to Identify Host Computers
    That Do Not Have The 823980 Security Patch (MS03-026) Installed
    http://support.microsoft.com/search/preview.aspx?id=kb;en-us;826369

    W32.Blaster.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

    W32.Blaster.B.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html

    W32.Blaster.C.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html

    W32.Blaster.Worm Removal Tool
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


    On Thu, 21 Aug 2003 18:53:14 -0400, in
    <v3c1b.2364$>
    hugh jass scrawled:

    >I'm trying to help a friend over the phone with a computer problem.
    >He tells me that when he shuts down Outlook Express, sometimes it initiates
    >the os shutdown process. It doesn't give him an option and just goes ahead
    >with shutdown. This has happened a few times, but not every time.
    >He has also noticed that his dialup internet connection is getting slower
    >all the time.
    >Worried that he may have the Blaster virus, he asked me to send him some
    >info on it.
    >He went into Regedit as I advised, but instead of navigating to the location
    >(...Run/WindowsAutoUpdate/), he
    >did a Find on the msblast.exe file.
    >Regedit found 'msblast.exe' in My
    >Computer\HKEY_USERS\S-1-5-21-220523388-1060284298-1343024091\Identities\' in
    >one of the identities. I advised that he delete it.
    >Anyone know what it was doing here and if this could be one of the causes of
    >his pain? It's not found in the usual location, where I found it on my
    >system before.
    >Anyone know if this behaviour is a virus? Any suggestions on what to do?
    >Thanks much, hj.
    >______________________
    >"peace - it's worth killing for"
    > - Bush
    >
    >
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 22, 2003
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Ted
    Replies:
    19
    Views:
    50,037
    Badger
    Sep 9, 2003
  2. DEFIANT1

    OUtlook Express crashing..........

    DEFIANT1, Feb 3, 2005, in forum: Computer Support
    Replies:
    2
    Views:
    552
  3. Zap Eagle

    Outlook express can't open pdf without crashing

    Zap Eagle, Mar 29, 2005, in forum: Computer Support
    Replies:
    3
    Views:
    2,136
    Zap Eagle
    Mar 30, 2005
  4. Marc
    Replies:
    5
    Views:
    1,532
    John Holmes
    Aug 22, 2006
  5. Skybuck Flying
    Replies:
    9
    Views:
    11,671
    Tony Sperling
    May 27, 2007
Loading...

Share This Page