P2P & FILE SHARING Download Cheap Software
Audio Video Tools & UtilitiesWeight Loss ProgramHealth and FitnessVirus Recovery |
How to Remove MSBLAST.exe worm virus
What is the MSBLAST.EXE worm aka Blaster.A, LoveSan or Msblast.A?
The MSBLAST.A worm infects machines via network connections. It can attack entire networks of computers or one single computer connected to the Internet. The worm exploits a known windows vulnerability that is easily patched, however few systems seem to have this patch installed. It attacks Windows 2000 and Windows XP machines and exploits the DCOM RPC Vulnerablity. Depending on the system date it will start a Denial of Service attack against windowsupdate.com, this makes it difficult to download the needed patches and allow the worm to infect as many machines as it can before being disabled. However, as of August 15th, Microsoft decided to kill the windowsupdate.com domain to lessen the impact from this denial of service attack. MSBLAST can also cause widespread system instability including but not limited to Windows Blue screens, out of memory errors, changes to Control Panel, inability to use functions in browser, and many more oddities.
What is the DCOM Vulnerability?
The DCOM vulnerability in Windows 2000 and XP can allow an attacker to
remotely compromise a computer running Microsoft® Windows® and
gain complete control over it. The worm causes a buffer overrun in the
Remote Procedure Call (RPC) service. When this service is terminated the
virus infects the machine and then tries to infect other machines.
What are the Symptoms of the MSBLAST worm?
You'll see a screen similar to the one below when you are infected, this will countdown to zero and literally shut down the system completely. The warning will state "This shutdown was initiated by NT AUTHORITY\SYSTEM". The message will read
Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly.
You can disable this shutdown by following the steps below during the countdown
Click on Start, Run
Type in CMD and press ENTER
Type in the following command and press Enter
SHUTDOWN -A
This will terminate the shutdown, however in most cases the system may
be to unstable to try to recover and may need to be rebooted anyway.