Beating Blaster: How to Prevent Your Computer from Falling Victim to the MS Blaster (LovSan) Worm

Chances are if you are connected to the internet, you have seen messages in your email groups or on your message boards from people pleading for help due to an "interrupted Remote Procedure Call (RPC)". What can you do so that you don't fall victim too?

On July 16th, Microsoft sent out an alert regarding this security hole in their Windows XP, Windows 2000 and Windows 98 operating system, and said it was only a matter of time before someone would write a program to exploit it. It took less than a month to happen, and despite the warnings, the many people who did not run their Windows Update and download the patch could find themselves infected with the worm, known as MS Blast, Blaster or LovSan.

If you find yourself facing the "This system is being shut down in 60 seconds by NT Authority/System due to an interrupted Remote Procedure Call (RPC)," message, or have received a frantic phone call from someone who has this problem, time is of the essence, since you only have a short window to get your update before your system shuts down and restarts again.

The first stop when your computer starts up again is to go to the start menu, select Run, then type "shutdown -a" into the box, then click on "OK". This will keep your computer from shutting down repeatedly while you try and download the Windows patch.

Then, you will need to go to Microsoft's update site, and download the patch, which can be found at http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

You can also go to http://v4.windowsupdate.microsoft.com/en/default.asp to download all the critical updates for your version of windows, which you should do if you haven't updated your operating recently, (or ever!)

Once you have successfully downloaded the patch, you then need to go and delete the worm. You can do this by getting instructions from an antivirus site, which will either remove the worm for you, or provide instructions for you.

To do it yourself you will need to go to your Task Manager.

First, press Ctrl-Alt-Del and click on the button to select the Task Manager. Look through the list of everything currently running on your computer and find msblast.exe . Then select End Process to stop it running.

Next, using Windows Explorer, search for the file "msblast.exe" and delete it. It will be in one of your windows system directories.

Then you will want to select Start, then Run, and type "regedit" into the popup box, which will enable you to run the registry editor. Find the HKEY_LOCAL_MACHINE section, click open SOFTWARE, and and then find the entry for Microsoft - Windows - CurrentVersion - Run - windows auto update, and delete it.

This worm is a good lesson of why it is so important to keep your windows operating system up to date. You can select auto-update so your computer will automatically download critical updates for you as they become available. You should also be running a current antivirus program, particularly one that offers a live update feature, saving you the hassle of remembering to update your antivirus software on a regular basis

About Us | Contact Us | Submission Guidelines |Privacy policy
Copyright 2001-2012