The Msblast Worm also known as Lovsan, Blaster or Posa is an internet worm that is not sent through email. It uses the Distributed Component Object Model (DCOM) Remote Procedure (RPC) interface buffer overflaw flaw to spread.

The Worm infects only Windows XP and 2000. The crashing of systems caused by the worm is caused when the worm used a Windows XP exploitation technique on a Windows 2000 machine and vice versa. The worm will use the Windows XP method over 80% of the time.

Users of Windows XP and 2000 should download a patch from Microsoft to stop future infection of the Msblast Worm. The URL is:

http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

Remove of the worm is fairly simple. Just follow the steps listed below.


REMOVAL

• Start Windows, click on "Task Manager" or press "Alternate-Control-Delete" then click on "Processes" and click once on the "msblast" process and then click on End Process.
• Delete "Msblast.Exe" from Windows\System32 folder. You can use V-Buster to detect and delete the file.
• Run Regedit and search for:
  Hkey_local_machine\software\Microsoft\Windows\CurrentVersion\Run "Windows auto update" =msblast.exe
  
  Delete the line when it is found. Editing and deleting the line is not absolutely necessary and the line will be redundant when the file Msblast.Exe is deleted. If the line is not deleted an error message will appear when Windows starts.

Return Home