KB 252
From SWCP Support Wiki
How do I tell if I've got the Blaster worm?
Article:252 Created:2003-09-17 11:16:02 Categories: Windows 95 Windows 98 Windows NT 4 Virus Information Windows 2000 Windows XP
Question or Symptom
I've heard about the MS Blaster Worm. How can I tell if I have it? What do I do if I do have it?
Resolution
Some symptoms of infection are:
* Error message that svchost.exe (or other software) has generated errors and must be restarted. * Not being able to copy and paste in various applications * System instability - applications that stop suddenly with no error message and will not restart * Unusual network traffic * Virus software that will not function properly * Inability to install new software
A search of your PC may show the file msblast.exe - often this file can not be deleted, fixed, or repaired by virus software that has not been updated very recently. Removal tools, virus updates and windows updates are available at:
* http://windowsupdate.microsoft.com/ * http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html * http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547 * http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A * http://housecall.trendmicro.com/
More information can be found at
* http://news.com.com/2100-1002-5062364.html?tag=nl * http://news.com.com/2100-1002_3-5062477.html?tag=lh * http://www.washingtonpost.com/wp-dyn/articles/A46233-2003Aug11.html (Subscription site) * http://www.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=3259235
More technical information describing the worm can be found on CERT's site: CERT Advisory CA-2003-20 W32/Blaster worm http://www.cert.org/advisories/CA-2003-20.html
Related URLS
http://windowsupdate.microsoft.com/ http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547 http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A http://housecall.trendmicro.com/ http://news.com.com/2100-1002-5062364.html?tag=nl http://news.com.com/2100-1002_3-5062477.html?tag=lh http://www.washingtonpost.com/wp-dyn/articles/A46233-2003Aug11.html http://www.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=3259235 http://www.cert.org/advisories/CA-2003-20.html
