Hello everyone. Like many other people here, my computer was infected
by the lovesan/msblast virus. I managed to remove the virus and fix
the problems it caused without the help of anti-virus software, and I
thought I'd share with everyone else.
This virus only infects computers running Windows 2000 or Windows XP.
I run Windows XP, so I do not know how much of the following
information applies to Windows 2000.
Here are the symptoms of the virus:
1) When Windows starts up, you may get an error message which says
that a file name "TFTP" (or something similar) cannot be found. The
filename will have a random number at the end. For example, mine was
"TFTP2434".
2) After Windows has been running for a few minutes, the following
error message occurs:
"This system is shutting down. Please save all work.
This shutdown was initiated by NT AUTHORITY\SYSTEM
Windows must now restart because the Remote Procedure Call (RPC)
service terminated unexpectedly."
After this message pops up, the system will shut down after one
minute, and there's nothing you can do to stop it. When Windows
restarts, the same thing will happen again after a few minutes.
3) Sometimes you will get the following message:
"Generic Host Process for Win32 Services
has encountered a problem and needs to close.
We are sorry for the inconvenience."
Closing this window will usually result in getting the "This system is
shutting down" message with the one minute countdown.
How to remove the virus:
Note: In order to prevent the system from crashing while you are
trying to remove the virus, you should start up your computer in Safe
Mode (*without* network support).
1) In Windows, press and hold down the ctrl, alt, and del keys to make
the Windows Task Manager pop up. Click on the Processes tab and look
for a process named msblast. This process is the virus running in your
computer memory. To remove it, click on it and then press the End
Process button. Now the virus is not running in the background.
2) Go to your C:\Windows\System32 folder and look for the file named
msblast.exe. Delete it. Now the virus cannot be executed again. Also
look in your C:\Windows\prefetch folder for files with similar names.
For example, I found a file named "msblast.exe -o9FF84F2.pf". If you
find any such files, delete them as well.
3) Click on the Start button and then click on Run. Type in "regedit"
and hit Enter. This will run the Windows registry editor. Navigate to
the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Click on the "Run" key and several values will appear to the right.
Look for the value named "windows auto update". The data for this
value will read "msblast.exe" or something similar. This is what makes
the virus start up every time Windows starts. Delete it.
4) Look in your StartUp folder in the start menu for a file name
"TFTP" or something similar. This is responsible for the error message
that occurs when windows starts up. Delete this file.
Note: If you started up in safe mode, you now need to reboot your
computer in normal mode in order to access the internet.
Another Note: With the virus removed, you'd think your computer
wouldn't crash anymore but mine still did (although it didn't seem to
do it as quickly as before). After I ran Windows Update, the crashes
stopped (see bellow).
5) Next, run Windows Update from the Start Menu. This will patch the
bug that allowed you to get the virus in the first place.
Specifically, the patch you are looking for has the id number 823980.
You should probably select just that patch because the system might
still shut down at any minute (although this did not happen to me
during the update). Once the patch is installed you should stop
getting error messages and you can then download other patches if you
want to.
6) The virus can still be in your Recycle Bin or in a System Restore
backup. To be safe you should now empty your Recycle Bin. Next you
should disable and re-enable System Restore. This should delete your
backups. To disable System Restore, first run the System Restore
program (It should be in your start menu under
programs\accessories\system tools\) and then click on the link that
says "System restore settings." Check the checkbox that says "turn off
system restore on all drives" and hit ok. You can re-enable it the
same way.
Hope this helps.
For further information:
http://us.mcafee.com/virusInfo/defa...&virus_k=100547
http://securityresponse.symantec.co...aster.worm.html
http://www.f-secure.com/v-descs/msblast.shtml