Information on MSBLAST.EXE virus

[Patrickboy]

My office computer is showing a unknown error message. After the error message the computer shutdown's. The message shows 'The system is shutting down. Please save your all work in progress. etc' something like that. And goes off. It had happened many time. Somebody told me that it is affected by a msblast.exe virus. It is worm. I think my computer is affected with virus. If yes then what are the tools available to remove it.

[Shen]

Yes you are affected with a blaster worm type of virus. It also called msblast.exe. It exploit the DCOM RPC vulnerability using a TCP port. It downloads a .exe file to the %WinDir%\system32 directory and execute it. It spreads through the network thus making a automated shutdown of system. To remove this virus run the Task Manager by right clicking on the taskbar or pressing Ctrl+Alt+Delete. In the taskbar find the process called msblast.exe. Give End Process to all the processes.
Dowload Symantec W32.Blaster.Worm Removal Tool to remove it completely from the computer.

[Snake08]

Try one of the following steps to remove the virus :

1. Go to Start Menu > Programs > Accessories > System Tools > System Information
2. Click on Tools >System Configuration Utility
3. Click on the Startup Tab.
4. Find the similar program named like msblast.exe
5. Uncheck the box and click Ok.
6. Restart your computer.

[Spyrus]

Making some changes in windows registry will remove this virus.
Go to Start Menu > Run > Type regedit.
Navigate to the tree HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete entry called 'windows auto update' - It should mention msblast.exe
Restart your computer

And then Download the below security patches to update your windows
WindowsXP-KB823980-x86-ENU.exe