Page 2
“LovSan” msblaster.exe Worm and How
to Remove It.
by
Keith Benicek, Managing Editor
August12th, 2003
If you’ve got it, let’s get rid of it!
If you’ve neglected to download the Microsoft patch (shame on you) and the “MSBlast.exe Worm has found your unprotected computer, we’ve got to do a little exterminating and here’s how:
First
things first –
You need to physically disconnect your computer from the network or
your Internet connection. As long as you’re connected, you are
(the MSBlaster Worm) is spreading it to others.
Second
–
We need to turn off the worm by using the “Task Manager”.
With your keyboard, press ctrl, alt and delete keys all at the same
exact time. The “Windows Task Manager” window will pop up,
at which point you click on the “Processes” tab and scroll
down the list until you find MSBAST.EXE. Select it (highlighted) and
click on the “End Process” button, then click on “yes”
when the warning window comes up. The “LovSan” worn engine
is now turned off.
Third
–
Do a search of your computer using the “Start” - “Search”
– “For Files or Folder” in Windows, for “msblast.exe”
and then delete all the files by that, AND ONLY THAT name.
Fourth
–
Now that “Blaster” is 99% crippled, there just may be some
hidden files you missed, you should also go to Symantec’s (Norton
Anti-Virus) site for their very thorough removal tool.
Reconnect to your network or Internet connection. Launch your browser and type in www.symantec.com and look for “STEP 3: Download Removal Tool” or click on this link click here.
There are actually three versions of the “msblaster” worm, “W32.Blaster.Worm, W32.Blaster.B.Worm, and W32.Blaster.C.Worm infections.” The page also has some instruction for you to follow.
Here’s the direct
link to download the Symantec Fix Tool:
click
here
Remember, if you were very careful and thorough in the “Third – “ step I outline, this may not be necessary.
If you do run the Symantec Removal tool, here’s an important note from Symantec on what to do before running the tool: “Users of Windows XP should temporarily turn off System Restore. Windows XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.”
On the desktop, right-click on My Computer, then click on Properties, click on the System Restore tab and click in the box next to Turn off system restore on all drives. Then click Apply and then finally click OK. Remember, when all is done at the end of this “fix” process, turn System Restore BACK ON!
Now you can run the Symantec Removal tool, “FixBlast.exe”
Fifth
–
Ok, now that the “Blaster” worm is completely out of you system,
it’s time to do what you should have done on July 16th and this
to down load the Patch from the Microsoft site.
Open your browser again and go to the Microsoft site, by click on this link here, or by going to the Microsoft update checking page here.
You can also use the “Windows Update” function in the Windows 2000 or XP Start Menu. Search for the “Critical Updates”, and by the way . . . . do this once a month, please!
The following Microsoft products require updating:
· Microsoft
Windows NT® 4.0
· Microsoft Windows 2000
· Microsoft Windows XP
· Microsoft Windows Server™ 2003
Windows 95 (you’re still using that?), Windows 98/SE or Windows ME at not at risk.
Sixth,
You’re done –
Hey, did you forget to turn System Restore back on? Just Do It.
about us
| current articles | archive
| home | advertise!
all right reserved copyright ©1999-2003. E-mail us.
