Weird virus...

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Hello,

On my home PC today, I got a warning from my anti-virus:
28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
File contains: Worm/MSBlast.J
28.06.2005 19:59:20: Access will be denied.

I've never heard of "MSBlast.J" (nor has Google) and not heard of the
Blaster worm ever residing in an OCX or in Windows 98!

Anybody have any idea what this could be and how could it have come to
my computer?

Thanks.

--
Model: INFJ
Primary function: Coprocessor
Secondary function: Cluster commander

Yes I'm a therian:
http://www.wikitherian.org

Powered by Deamons(TM).

....to live your life fast
and powerfull; and then
live your life just to keep
the Deamons at bay.
12 answers Last reply
More about weird virus
  1. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    Don't you just *love* being on the cutting edge, <eg>?

    --
    Gary S. Terhune
    MS MVP Shell/User
    http://www.grystmill.com/articles/cleanboot.htm
    http://www.grystmill.com/articles/security.htm

    "Jure Sah" <jure.sah@guest.arnes.si> wrote in message
    news:Y_gwe.13031$F6.2816515@news.siol.net...
    > I use Anti-Vir but the thing is the virus (Worm/MSBlast.J) is nowhere
    > to be found in their own virus encyclopedia!
    >
    > I'm considering this to be a false positive since the recgotnition of
    > that worm turned out to be added at 10 am this morning, but I've
    > downloaded a replacement for that OCX from the net and that one scans
    > clean!
    >
    > I hope I haven't been devoloping trojanned software all along. :/
  2. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    > Hello,
    >
    > On my home PC today, I got a warning from my anti-virus:
    > 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    > File contains: Worm/MSBlast.J
    > 28.06.2005 19:59:20: Access will be denied.
    >
    > I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    > Blaster worm ever residing in an OCX or in Windows 98!
    >
    > Anybody have any idea what this could be and how could it have come to
    > my computer?

    What AV are you using?
  3. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    From: "Jure Sah" <jure.sah@guest.arnes.si>

    | Hello,
    |
    | On my home PC today, I got a warning from my anti-virus:
    | 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    | File contains: Worm/MSBlast.J
    | 28.06.2005 19:59:20: Access will be denied.
    |
    | I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    | Blaster worm ever residing in an OCX or in Windows 98!
    |
    | Anybody have any idea what this could be and how could it have come to
    | my computer?
    |
    | Thanks.
    |
    | --
    | Model: INFJ
    | Primary function: Coprocessor
    | Secondary function: Cluster commander
    |
    | Yes I'm a therian:
    | http://www.wikitherian.org
    |
    | Powered by Deamons(TM).
    |
    | ...to live your life fast
    | and powerfull; and then
    | live your life just to keep
    | the Deamons at bay.

    What are you trying to accomplish by discussing this in a Win98 News Group and not in a
    virus News ?

    microsoft.public.scripting.virus.discussion
    microsoft.public.security.virus
    alt.comp.virus
    alt.comp.anti-virus

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
  4. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    Gary S. Terhune wrote:
    > Don't you just *love* being on the cutting edge, <eg>?

    Oh there's no excuse with this anti-virus hehe, they've been releasing
    an update (with 4 to 20 new viruses) every 2 to 12 hours for a year now.

    I wonder where they find so many viruses!

    --
    Model: INFJ
    Primary function: Coprocessor
    Secondary function: Cluster commander

    Yes I'm a therian:
    http://www.wikitherian.org

    Powered by Deamons(TM).

    ....to live your life fast
    and powerfull; and then
    live your life just to keep
    the Deamons at bay.
  5. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    Sssshhhhh! (It's a world-wide conspiracy--the AV people *are* the virus
    writers, heh, heh...)

    Not really... At least I don't *think* that last part is true in most
    cases. But it *is* a worldwide conspiracy of sorts. Lots and lots of
    people who make it their business to "keep their ear to the ground" and
    report anything that comes up. Many in the corporate IT world,
    government agencies, etc. Just as there is a huge network of evil-doing
    hackers, there's a *much* bigger network of people fighting them.

    --
    Gary S. Terhune
    MS MVP Shell/User
    http://www.grystmill.com/articles/cleanboot.htm
    http://www.grystmill.com/articles/security.htm

    "Jure Sah" <jure.sah@guest.arnes.si> wrote in message
    news:Johwe.13037$F6.2816488@news.siol.net...
    > Gary S. Terhune wrote:
    >> Don't you just *love* being on the cutting edge, <eg>?
    >
    > Oh there's no excuse with this anti-virus hehe, they've been releasing
    > an update (with 4 to 20 new viruses) every 2 to 12 hours for a year
    > now.
    >
    > I wonder where they find so many viruses!
    >
    > --
    > Model: INFJ
    > Primary function: Coprocessor
    > Secondary function: Cluster commander
    >
    > Yes I'm a therian:
    > http://www.wikitherian.org
    >
    > Powered by Deamons(TM).
    >
    > ...to live your life fast
    > and powerfull; and then
    > live your life just to keep
    > the Deamons at bay.
    >
  6. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    "Jure Sah" <jure.sah@guest.arnes.si> wrote in message
    news:jygwe.13029$F6.2816386@news.siol.net...
    > Hello,
    >
    > On my home PC today, I got a warning from my anti-virus:
    > 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    > File contains: Worm/MSBlast.J
    > 28.06.2005 19:59:20: Access will be denied.
    >
    > I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    > Blaster worm ever residing in an OCX or in Windows 98!
    >
    > Anybody have any idea what this could be and how could it have come to
    > my computer?

    Have a look at Worm/LOVSAN alias Blaster. It is shown on this site as
    MSBlast
    http://www.answersthatwork.com/Tasklist_pages/tasklist_m.htm

    Regards,
    Emrys Davies.
  7. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    Emrys Davies wrote:
    >>On my home PC today, I got a warning from my anti-virus:
    >>28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    >> File contains: Worm/MSBlast.J
    >>28.06.2005 19:59:20: Access will be denied.
    >>
    >>I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    >>Blaster worm ever residing in an OCX or in Windows 98!
    >>
    >>Anybody have any idea what this could be and how could it have come to
    >>my computer?
    >
    > Have a look at Worm/LOVSAN alias Blaster. It is shown on this site as
    > MSBlast
    > http://www.answersthatwork.com/Tasklist_pages/tasklist_m.htm

    This is MSBlast.exe, I have it in MSWinSCK.OCX! =P


    --
    Model: INFJ
    Primary function: Coprocessor
    Secondary function: Cluster commander

    Yes I'm a therian:
    http://www.wikitherian.org

    Powered by Deamons(TM).

    ....to live your life fast
    and powerfull; and then
    live your life just to keep
    the Deamons at bay.
  8. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    "Jure Sah" <jure.sah@guest.arnes.si> wrote in message
    news:gSjwe.5$cE1.472@news.siol.net...
    > Emrys Davies wrote:
    > >>On my home PC today, I got a warning from my anti-virus:
    > >>28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    > >> File contains: Worm/MSBlast.J
    > >>28.06.2005 19:59:20: Access will be denied.
    > >>
    > >>I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    > >>Blaster worm ever residing in an OCX or in Windows 98!
    > >>
    > >>Anybody have any idea what this could be and how could it have come to
    > >>my computer?
    > >
    > > Have a look at Worm/LOVSAN alias Blaster. It is shown on this site as
    > > MSBlast
    > > http://www.answersthatwork.com/Tasklist_pages/tasklist_m.htm
    >
    > This is MSBlast.exe, I have it in MSWinSCK.OCX! =P

    There are a number of possibilities as to the exact identity
    of the worm that you have acquired, as you will see
    if you run a google web search for

    MSWINSCK.OCX worm
  9. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    jkb wrote:
    >>Hello,
    >>
    >>On my home PC today, I got a warning from my anti-virus:
    >>28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    >> File contains: Worm/MSBlast.J
    >>28.06.2005 19:59:20: Access will be denied.
    >>
    >>I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    >>Blaster worm ever residing in an OCX or in Windows 98!
    >>
    >>Anybody have any idea what this could be and how could it have come to
    >>my computer?
    >
    >
    > What AV are you using?

    AntiVir by HBEDV.

    --
    Model: INFJ
    Primary function: Coprocessor
    Secondary function: Cluster commander

    Yes I'm a therian:
    http://www.wikitherian.org

    Powered by Deamons(TM).

    ....to live your life fast
    and powerfull; and then
    live your life just to keep
    the Deamons at bay.
  10. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    Have you tried the various online scanners for their assessment?
    For starters, www.pandasoftware.com

    "Jure Sah" <jure.sah@guest.arnes.si> wrote in message
    news:jygwe.13029$F6.2816386@news.siol.net...
    > Hello,
    >
    > On my home PC today, I got a warning from my anti-virus:
    > 28.06.2005 19:59:20: C:\WINZ98\SYSTEM\MSWINSCK.OCX
    > File contains: Worm/MSBlast.J
    > 28.06.2005 19:59:20: Access will be denied.
    >
    > I've never heard of "MSBlast.J" (nor has Google) and not heard of the
    > Blaster worm ever residing in an OCX or in Windows 98!
    >
    > Anybody have any idea what this could be and how could it have come to
    > my computer?
    >
    > Thanks.
    >
    > --
    > Model: INFJ
    > Primary function: Coprocessor
    > Secondary function: Cluster commander
    >
    > Yes I'm a therian:
    > http://www.wikitherian.org
    >
    > Powered by Deamons(TM).
    >
    > ...to live your life fast
    > and powerfull; and then
    > live your life just to keep
    > the Deamons at bay.
    >
  11. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    David H. Lipman wrote:
    > What are you trying to accomplish by discussing this in a Win98 News Group and not in a
    > virus News ?

    And what are you trying to accomplish by bitching around randomly. I
    asked people if they ever seen a blaster virus in Windows 98 as I
    thought it was was impossible. I was being quite on topic.

    FYI

    --
    Model: INFJ
    Primary function: Coprocessor
    Secondary function: Cluster commander

    Yes I'm a therian:
    http://www.wikitherian.org

    Powered by Deamons(TM).

    ....to live your life fast
    and powerfull; and then
    live your life just to keep
    the Deamons at bay.
  12. Archived from groups: microsoft.public.win98.gen_discussion (More info?)

    From: "Jure Sah" <jure.sah@guest.arnes.si>


    |
    | And what are you trying to accomplish by bitching around randomly. I
    | asked people if they ever seen a blaster virus in Windows 98 as I
    | thought it was was impossible. I was being quite on topic.
    |
    | FYI
    |

    You asked a specific quaetion about a virus declaration and such a question is *best*
    answered in a AV News Group. The News Group; alt.comp.virus would be the best of all the
    AV related News Groups for such a subject matter. The fact is that this declaration was NOT
    the Lovsan/Blaster worm. It's coennection the the Lovsan/Blaster was based upon your
    confusion of the name and it connection to being "On Topic" in a Win98 News Group is
    scantily slim. The Lovsan/Blaster could *NEVER* infect a Win9x/ME platform because the
    Win9x/ME family does not have the same RPC/RPCSS DCOM service buffer overflow vulnerability
    that the Lovsan/Blaster exploits through TCP port 135 as on NT based OS'.

    To add to that, you justs stated "...from my anti-virus:" without staing what the AV package
    it was nor what its Engine and Signature revisions were. It had to be queried. It could
    just have been a False Positive declaration, maybe it wasn't. However, MSWINSCK.OCX is a
    commonly used, benign, MS ActiveX control file that is used by several viruses and Trojans
    because they are coded in MS Visual Basic and would require Visual Basic Runtime files as
    well (i.e, MSVBVM50.DLL). Examples are...

    Armageddon -- http://vil.nai.com/vil/content/v_10182.htm
    Grador -- http://vil.nai.com/vil/content/v_99613.htm
    W95/Music@M -- http://vil.nai.com/vil/content/v_98889.htm
    W32/Naco.b@MM -- http://vil.nai.com/vil/content/v_100331.htm
    W32/Noomy.a@MM -- http://vil.nai.com/vil/content/v_128744.htm
    W32/RunFtp.worm -- http://vil.nai.com/vil/content/v_98486.htm
    W32/Yodo.a@MM -- http://vil.nai.com/vil/content/v_100602.htm

    You would have found out MUCH information if you had submitted "MSWINSCK.OCX" to Virus
    Total --
    http://www.virustotal.com/flash/index_en.html
    The submission would have then been tested against 18 different AV vendor's scanners.


    As for "...bitching around randomly".
    When it comes to discussions about computer infectors I am *very* serious.

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
Ask a new question

Read More

Windows