*MANUAL REMOVAL INSTRUCTIONS*

*Terminating the Malware Program*

This procedure terminates the running malware process from memory.

1. Open Windows Task Manager press
CTRL+SHIFT+ESC, and click the Processes tab.
2. In the list of running programs*, locate the process:
MSBLAST.EXE
3. Select the malware process, then press either the the End Process
button.
4. To check if the malware process has been terminated, close Task
Manager, and then open it again.
5. Close Task Manager.

*Removing Autostart Entries from the Registry*

Removing autostart entries from the registry prevents the malware from
executing during startup.

1. Open Registry Editor. To do this, click Start>Run, type Regedit,
then press Enter.
2. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
?windows auto update" = MSBLAST.EXE
4. Close Registry Editor.

*NOTE:* If you were not able to terminate the malware process from
memory as described in the previous procedure, restart your system.

*Additional Windows ME/XP Cleaning Instructions
http://www.trendmicro.com/en/security/a ... clean.htm*

I already tried that on 2 systems now, both XP, but it only worked on 1. For some reason on the other system it kept puting the bleeder back, but they were running osme weird software to protect from accidental deletion etc etc All was fine after that. if anyone has Nortons AV they should be able to get a link for the removal tool too.

actually now i think about it there was a second entry in the registry that i didnt recognise so i just deleted it as well (no idea what it was though, sorry) as i check the registry every couple of days anyway (try the current_user key as well)

Indeed - first I let trend micro systems crappy online scan loose onit....found and delelted 1 reg key

Then laterthat day the norton tool found 2 More....

as of yet (after installing MS patch) stable

My buddies machine was fucked from this.

But he did the symantec fix, and it found nothing.

He rebooted to the same shutdowns.

Told him the old Start/run "shutdown /a".
Then he applied the Hotfix.

All worked fine.=)

I had a machine yesterday that had all this NOrton shit running on it, and it kept saying it was infected, but the rmeoval tool found nothing, and nothing was in the registry where it should have been not even msblast in the right directory, but the fucker was there in the processes and was starting with XP. Everytime I did a search it found nothing matching *blast*.*, most annoying. I deleted all the norton shit and installed sygate pro and AVG and bugger me the removal tool found a killed it, then applied patch and all was fine. That Norton shit can be a real pain in the arse, but I have never used it for a while now as it was too much of a drain on resources, and the AV component was unreliable as fuck mate.

1st off, you should ALWAYS have Startup Items Unchecked within MSCONFIG/General/selective startup.