Una,
Here are links specific to this particular worm to the major anti-virus
software providers:
Network Associates (McAfee):
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547
Trend Micro:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST
..A
Symantec (Norton):
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.htm
l
Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36265
Because it is possible that you will not be able to get the update/cleaning
done before your computer reboots, the following post from Paul Anderson in
the "microsoft.public.security" newsgroup may be helpful:
BEGIN QUOTED MATERIAL
FIRST THINGS FIRST...I know you don't have a lot of time
before your RPC window pops up and shuts you down, but
because you will be disconnecting from the internet for
part of this procedure, read this fast and REMEMBER!
1) UNPLUG YOUR MODEM. This should allow you free time
to make some changes to your computer (after you reboot,
if your RPC window pops up and requires you to do so).
2) When you are not connected to the internet, go
to "Control Panel," "Performance and
Maintenance," "Administrative Tools," open "Services,"
right click on "Remote Procedure Call,"
click "Properties," click the "Recovery" tab, at "First
Failure," "Second Failure," and "Subsequent Failures,"
select "Take No Action."
3) Turn on your modem and reconnect to the internet.
4) You've probably run out of time reading this before
your computer has rebooted, so get back to this message
and read from step 5 on. At this stage, you are still
infected with the msblast virus, but your computer will
not reboot on you.
5) This virus is very clever and has disabled several
buttons on the web and on your computer that would
otherwise allow you to disable it, so you've got to go
around the back door.
6) From support.microsoft.com, download:
WindowsXP-KB823980-x86-ENU.exe
(this is for XP; there is a Windows 2000 version
also...try a search on the Microsoft Support
website...plugging in this file name should bring you to
the same page as the security patches for the other
Windows versions).
7) Download and install.
8) Reboot.
9) Now you should be able to have a little more
functionality in your computer. If you havent' done so
already, enable your firewall:
"Control Panel," then "Network and Internet Connections,"
then "Network Connections," right click on your active
internet connection, select "Properties," click on
the "Advanced" tab, and check the box enabling firewall
protection.
10) Now let's kill the virus. Go to:
http://housecall.trendmicro.com/housecall/start_corp.asp
It's a free antivirus detection and cleanup program.
11) Run the program (this takes a long time). The
program should detect the msblast virus; it states that
it is non-cleanable. Click the "delete" button to delete
the virus.
12) To be sure, run the Search program from your Start
menu. Search for "msblast.exe" Include all hidden files
and folders in your search. If you have been successful,
no files will appear.
13) Congratulations! You're cured! Now download all the
security patches and updates that Microsoft bugs you
about everytime you boot your computer...I have been
ignoring it for months and this is what happened.
END QUOTED MATERIAL
