Post by yummy on Jul 22, 2004 10:24:59 GMT -5
What You Should Know About the Blaster Worm
The Blaster worm (W32.Blaster.A and its variants) exploits a security issue related to the Remote Procedure Call (RPC) function that was addressed by the security update released on July 16 in conjunction with Security Bulletin MS03-026.
How to Tell If the Worm Is Affecting Your Computer
Some customers whose computers have been infected may not notice the presence of the worm at all, while others who are not infected may experience problems because the worm is attempting to attack their computer. Typical symptoms may include Microsoft® Windows® XP and Windows Server™ 2003 systems restarting every few minutes without user input, or Windows NT™ 4.0 and Windows 2000 systems becoming unresponsive.
Shutdown error. If your computer is infected, you may see this error message.
If your system is shutting down, follow these steps to stop the cycle. Then proceed to Step 2 to help secure your computer against the worm.
To end the Blaster worm process
1. Press Ctrl+Alt+Delete.
2. Click the Task Manager button.
3. Click the Processes tab.
4. Click the Image Name column header to sort the processes alphabetically by name.
5. Look for a process named Msblast.exe. If you find it, click the name to select the process, and then click the End Process button.
6. Close the Task Manager.
Protect Your PC
Go to Protect Your PC and follow all three steps (set up a firewall, get software updates, and use up-to-date antivirus software) to help secure your computer against the Blaster worm.
Remove the Worm
Use the Blaster removal tool for Windows 2000 and Windows XP to remove the worm from your system. There are two ways to get this tool.
* Visit Windows Update and install critical update 833330 if it is listed as available
* Download the update directly from the Microsoft Download Center and install it
Free worm removal tools are also available from your preferred antivirus software vendor's Web site.
The Blaster worm (W32.Blaster.A and its variants) exploits a security issue related to the Remote Procedure Call (RPC) function that was addressed by the security update released on July 16 in conjunction with Security Bulletin MS03-026.
How to Tell If the Worm Is Affecting Your Computer
Some customers whose computers have been infected may not notice the presence of the worm at all, while others who are not infected may experience problems because the worm is attempting to attack their computer. Typical symptoms may include Microsoft® Windows® XP and Windows Server™ 2003 systems restarting every few minutes without user input, or Windows NT™ 4.0 and Windows 2000 systems becoming unresponsive.
Shutdown error. If your computer is infected, you may see this error message.
If your system is shutting down, follow these steps to stop the cycle. Then proceed to Step 2 to help secure your computer against the worm.
To end the Blaster worm process
1. Press Ctrl+Alt+Delete.
2. Click the Task Manager button.
3. Click the Processes tab.
4. Click the Image Name column header to sort the processes alphabetically by name.
5. Look for a process named Msblast.exe. If you find it, click the name to select the process, and then click the End Process button.
6. Close the Task Manager.
Protect Your PC
Go to Protect Your PC and follow all three steps (set up a firewall, get software updates, and use up-to-date antivirus software) to help secure your computer against the Blaster worm.
Remove the Worm
Use the Blaster removal tool for Windows 2000 and Windows XP to remove the worm from your system. There are two ways to get this tool.
* Visit Windows Update and install critical update 833330 if it is listed as available
* Download the update directly from the Microsoft Download Center and install it
Free worm removal tools are also available from your preferred antivirus software vendor's Web site.