RE: strange dllhost and email

  • From: "Sunil Shetty" <shetty.s@xxxxxxxxxxxxx>
  • To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Fri, 5 Sep 2003 19:57:35 +0530

Messagehi hery,

http://trendmicro.com/download/tsc.zip

This utility should help you clean the registry entries, which blaster worm has 
created, if any.

regards,
Sunil Shetty
  ----- Original Message ----- 
  From: Hery 
  To: [ExchangeList] 
  Sent: Tuesday, September 02, 2003 10:17 AM
  Subject: [exchangelist] RE: strange dllhost and email


  http://www.MSExchange.org/

  hi jamie,
  i'm check the whole drive c:\.  and found only two dllhost.exe at drive c.

  c:\winnt\system32\DLLHOST.EXE             (6 KB)
  c:\winnt\servicepackfiles\i386\dllhost.exe    (6 KB)

  i didn't found anything regarding to dllhost.exe at registry entry.

  rgds,
  hery
    ----- Original Message ----- 
    From: Jamie A. Byrnes 
    To: [ExchangeList] 
    Sent: Tuesday, September 02, 2003 11:12 AM
    Subject: [exchangelist] RE: strange dllhost and email


    http://www.MSExchange.org/


    This is a multi-part message in MIME format.



----------------------------------------------------------------------------


    Hi Hery,

    I am almost certain you have w32.blaster.d

    check in c:\windows\system32\wins\ as suggested by chris, although you 
can't be sure of which varient of blaster it is so can't be sure where it puts 
it - could try searching whole c: for dllhost.exe. Also check the usual 
run/runonce key in the registry (/HKLM/software/microsoft/current version/run).

    This variant was released only a couple (maybe 3) days ago, update your 
virus defs again or try trend housecall to be sure there is no virus there.


    Jamie.
  ------------------------------------------------------
  List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
  Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
  Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ
  ------------------------------------------------------
  Other Internet Software Marketing Sites:
  Leading Network Software Directory: http://www.serverfiles.com
  No.1 ISA Server Resource Site: http://www.isaserver.org
  Windows Security Resource Site: http://www.windowsecurity.com/
  Network Security Library: http://www.secinf.net/
  Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
  ------------------------------------------------------
  You are currently subscribed to this MSExchange.org Discussion List as: 
shetty.s@xxxxxxxxxxxxx
  To unsubscribe send a blank email to $subst('Email.Unsub') 

Other related posts: