Sign in with
Sign up | Sign in
Your question

Weird virus...

Tags:
Last response: in Windows 95/98/ME
Share
Anonymous
June 29, 2005 12:20:21 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Hello,

On my home PC today, I got a warning from my anti-virus:
28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
File contains: Worm/MSBlast.J
28.06.2005 19:59:20: Access will be denied.

I've never heard of "MSBlast.J" (nor has Google) and not heard of the
Blaster worm ever residing in an OCX or in Windows 98!

Anybody have any idea what this could be and how could it have come to
my computer?

Thanks.

--
Model: INFJ
Primary function: Coprocessor
Secondary function: Cluster commander

Yes I'm a therian:
http://www.wikitherian.org

Powered by Deamons(TM).

....to live your life fast
and powerfull; and then
live your life just to keep
the Deamons at bay.

More about : weird virus

Anonymous
June 29, 2005 12:20:22 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Don't you just *love* being on the cutting edge, <eg>?

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Jure Sah" <jure.sah@guest.arnes.si> wrote in message
news:Y_gwe.13031$F6.2816515@news.siol.net...
> I use Anti-Vir but the thing is the virus (Worm/MSBlast.J) is nowhere
> to be found in their own virus encyclopedia!
>
> I'm considering this to be a false positive since the recgotnition of
> that worm turned out to be added at 10 am this morning, but I've
> downloaded a replacement for that OCX from the net and that one scans
> clean!
>
> I hope I haven't been devoloping trojanned software all along. :/ 
Anonymous
June 29, 2005 12:20:22 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

> Hello,
>
> On my home PC today, I got a warning from my anti-virus:
> 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
> File contains: Worm/MSBlast.J
> 28.06.2005 19:59:20: Access will be denied.
>
> I've never heard of "MSBlast.J" (nor has Google) and not heard of the
> Blaster worm ever residing in an OCX or in Windows 98!
>
> Anybody have any idea what this could be and how could it have come to
> my computer?

What AV are you using?
Related resources
Anonymous
June 29, 2005 12:20:22 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "Jure Sah" <jure.sah@guest.arnes.si>

| Hello,
|
| On my home PC today, I got a warning from my anti-virus:
| 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
| File contains: Worm/MSBlast.J
| 28.06.2005 19:59:20: Access will be denied.
|
| I've never heard of "MSBlast.J" (nor has Google) and not heard of the
| Blaster worm ever residing in an OCX or in Windows 98!
|
| Anybody have any idea what this could be and how could it have come to
| my computer?
|
| Thanks.
|
| --
| Model: INFJ
| Primary function: Coprocessor
| Secondary function: Cluster commander
|
| Yes I'm a therian:
| http://www.wikitherian.org
|
| Powered by Deamons(TM).
|
| ...to live your life fast
| and powerfull; and then
| live your life just to keep
| the Deamons at bay.

What are you trying to accomplish by discussing this in a Win98 News Group and not in a
virus News ?

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
Anonymous
June 29, 2005 1:18:22 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Gary S. Terhune wrote:
> Don't you just *love* being on the cutting edge, <eg>?

Oh there's no excuse with this anti-virus hehe, they've been releasing
an update (with 4 to 20 new viruses) every 2 to 12 hours for a year now.

I wonder where they find so many viruses!

--
Model: INFJ
Primary function: Coprocessor
Secondary function: Cluster commander

Yes I'm a therian:
http://www.wikitherian.org

Powered by Deamons(TM).

....to live your life fast
and powerfull; and then
live your life just to keep
the Deamons at bay.
Anonymous
June 29, 2005 1:18:23 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Sssshhhhh! (It's a world-wide conspiracy--the AV people *are* the virus
writers, heh, heh...)

Not really... At least I don't *think* that last part is true in most
cases. But it *is* a worldwide conspiracy of sorts. Lots and lots of
people who make it their business to "keep their ear to the ground" and
report anything that comes up. Many in the corporate IT world,
government agencies, etc. Just as there is a huge network of evil-doing
hackers, there's a *much* bigger network of people fighting them.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Jure Sah" <jure.sah@guest.arnes.si> wrote in message
news:Johwe.13037$F6.2816488@news.siol.net...
> Gary S. Terhune wrote:
>> Don't you just *love* being on the cutting edge, <eg>?
>
> Oh there's no excuse with this anti-virus hehe, they've been releasing
> an update (with 4 to 20 new viruses) every 2 to 12 hours for a year
> now.
>
> I wonder where they find so many viruses!
>
> --
> Model: INFJ
> Primary function: Coprocessor
> Secondary function: Cluster commander
>
> Yes I'm a therian:
> http://www.wikitherian.org
>
> Powered by Deamons(TM).
>
> ...to live your life fast
> and powerfull; and then
> live your life just to keep
> the Deamons at bay.
>
Anonymous
June 29, 2005 2:39:08 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Jure Sah" <jure.sah@guest.arnes.si> wrote in message
news:jygwe.13029$F6.2816386@news.siol.net...
> Hello,
>
> On my home PC today, I got a warning from my anti-virus:
> 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
> File contains: Worm/MSBlast.J
> 28.06.2005 19:59:20: Access will be denied.
>
> I've never heard of "MSBlast.J" (nor has Google) and not heard of the
> Blaster worm ever residing in an OCX or in Windows 98!
>
> Anybody have any idea what this could be and how could it have come to
> my computer?

Have a look at Worm/LOVSAN alias Blaster. It is shown on this site as
MSBlast
http://www.answersthatwork.com/Tasklist_pages/tasklist_...

Regards,
Emrys Davies.
Anonymous
June 29, 2005 4:06:27 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Emrys Davies wrote:
>>On my home PC today, I got a warning from my anti-virus:
>>28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
>> File contains: Worm/MSBlast.J
>>28.06.2005 19:59:20: Access will be denied.
>>
>>I've never heard of "MSBlast.J" (nor has Google) and not heard of the
>>Blaster worm ever residing in an OCX or in Windows 98!
>>
>>Anybody have any idea what this could be and how could it have come to
>>my computer?
>
> Have a look at Worm/LOVSAN alias Blaster. It is shown on this site as
> MSBlast
> http://www.answersthatwork.com/Tasklist_pages/tasklist_...

This is MSBlast.exe, I have it in MSWinSCK.OCX! =P


--
Model: INFJ
Primary function: Coprocessor
Secondary function: Cluster commander

Yes I'm a therian:
http://www.wikitherian.org

Powered by Deamons(TM).

....to live your life fast
and powerfull; and then
live your life just to keep
the Deamons at bay.
Anonymous
June 29, 2005 4:06:28 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Jure Sah" <jure.sah@guest.arnes.si> wrote in message
news:gSjwe.5$cE1.472@news.siol.net...
> Emrys Davies wrote:
> >>On my home PC today, I got a warning from my anti-virus:
> >>28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
> >> File contains: Worm/MSBlast.J
> >>28.06.2005 19:59:20: Access will be denied.
> >>
> >>I've never heard of "MSBlast.J" (nor has Google) and not heard of the
> >>Blaster worm ever residing in an OCX or in Windows 98!
> >>
> >>Anybody have any idea what this could be and how could it have come to
> >>my computer?
> >
> > Have a look at Worm/LOVSAN alias Blaster. It is shown on this site as
> > MSBlast
> > http://www.answersthatwork.com/Tasklist_pages/tasklist_...
>
> This is MSBlast.exe, I have it in MSWinSCK.OCX! =P

There are a number of possibilities as to the exact identity
of the worm that you have acquired, as you will see
if you run a google web search for

MSWINSCK.OCX worm
Anonymous
June 29, 2005 4:06:58 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

jkb wrote:
>>Hello,
>>
>>On my home PC today, I got a warning from my anti-virus:
>>28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
>> File contains: Worm/MSBlast.J
>>28.06.2005 19:59:20: Access will be denied.
>>
>>I've never heard of "MSBlast.J" (nor has Google) and not heard of the
>>Blaster worm ever residing in an OCX or in Windows 98!
>>
>>Anybody have any idea what this could be and how could it have come to
>>my computer?
>
>
> What AV are you using?

AntiVir by HBEDV.

--
Model: INFJ
Primary function: Coprocessor
Secondary function: Cluster commander

Yes I'm a therian:
http://www.wikitherian.org

Powered by Deamons(TM).

....to live your life fast
and powerfull; and then
live your life just to keep
the Deamons at bay.
Anonymous
June 29, 2005 11:09:51 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Have you tried the various online scanners for their assessment?
For starters, www.pandasoftware.com

"Jure Sah" <jure.sah@guest.arnes.si> wrote in message
news:jygwe.13029$F6.2816386@news.siol.net...
> Hello,
>
> On my home PC today, I got a warning from my anti-virus:
> 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
> File contains: Worm/MSBlast.J
> 28.06.2005 19:59:20: Access will be denied.
>
> I've never heard of "MSBlast.J" (nor has Google) and not heard of the
> Blaster worm ever residing in an OCX or in Windows 98!
>
> Anybody have any idea what this could be and how could it have come to
> my computer?
>
> Thanks.
>
> --
> Model: INFJ
> Primary function: Coprocessor
> Secondary function: Cluster commander
>
> Yes I'm a therian:
> http://www.wikitherian.org
>
> Powered by Deamons(TM).
>
> ...to live your life fast
> and powerfull; and then
> live your life just to keep
> the Deamons at bay.
>
Anonymous
July 1, 2005 4:10:18 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

David H. Lipman wrote:
> What are you trying to accomplish by discussing this in a Win98 News Group and not in a
> virus News ?

And what are you trying to accomplish by bitching around randomly. I
asked people if they ever seen a blaster virus in Windows 98 as I
thought it was was impossible. I was being quite on topic.

FYI

--
Model: INFJ
Primary function: Coprocessor
Secondary function: Cluster commander

Yes I'm a therian:
http://www.wikitherian.org

Powered by Deamons(TM).

....to live your life fast
and powerfull; and then
live your life just to keep
the Deamons at bay.
Anonymous
July 1, 2005 4:10:19 AM

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "Jure Sah" <jure.sah@guest.arnes.si>


|
| And what are you trying to accomplish by bitching around randomly. I
| asked people if they ever seen a blaster virus in Windows 98 as I
| thought it was was impossible. I was being quite on topic.
|
| FYI
|

You asked a specific quaetion about a virus declaration and such a question is *best*
answered in a AV News Group. The News Group; alt.comp.virus would be the best of all the
AV related News Groups for such a subject matter. The fact is that this declaration was NOT
the Lovsan/Blaster worm. It's coennection the the Lovsan/Blaster was based upon your
confusion of the name and it connection to being "On Topic" in a Win98 News Group is
scantily slim. The Lovsan/Blaster could *NEVER* infect a Win9x/ME platform because the
Win9x/ME family does not have the same RPC/RPCSS DCOM service buffer overflow vulnerability
that the Lovsan/Blaster exploits through TCP port 135 as on NT based OS'.

To add to that, you justs stated "...from my anti-virus:" without staing what the AV package
it was nor what its Engine and Signature revisions were. It had to be queried. It could
just have been a False Positive declaration, maybe it wasn't. However, MSWINSCK.OCX is a
commonly used, benign, MS ActiveX control file that is used by several viruses and Trojans
because they are coded in MS Visual Basic and would require Visual Basic Runtime files as
well (i.e, MSVBVM50.DLL). Examples are...

Armageddon -- http://vil.nai.com/vil/content/v_10182.htm
Grador -- http://vil.nai.com/vil/content/v_99613.htm
W95/Music@M -- http://vil.nai.com/vil/content/v_98889.htm
W32/Naco.b@MM -- http://vil.nai.com/vil/content/v_100331.htm
W32/Noomy.a@MM -- http://vil.nai.com/vil/content/v_128744.htm
W32/RunFtp.worm -- http://vil.nai.com/vil/content/v_98486.htm
W32/Yodo.a@MM -- http://vil.nai.com/vil/content/v_100602.htm

You would have found out MUCH information if you had submitted "MSWINSCK.OCX" to Virus
Total --
http://www.virustotal.com/flash/index_en.html
The submission would have then been tested against 18 different AV vendor's scanners.


As for "...bitching around randomly".
When it comes to discussions about computer infectors I am *very* serious.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
!