Windows XP Tutorials
How To Remove MSBLAST.EXE From Windows XP
MSBLAST.EXE is sometimes called LoveSan, Blaster.A, Blaster and Msblast.A, but what ever the name the issue is the same it causes a 60 second (1 minute) shutdown procdure. This can cause may issues for users as everytime you start up your computer you end up having 60 seconds of use and then your computer is off again, causing frustration amung others.
The Blaster Worm uses the DCOM/RPC vulnerability in widows XP and 2000, the DCOM vulnerability allows attacker to take complete control of your computer and if thats not bad enough the worm will terminate RPC (Remote Procedure call) at which point the worm will try to infect other computers.
In the following tutorial I'm going to show you first how to stop the 60 second shutdown, once youve stoped the shutdown you have the time needed to locate and download the patch from Microsoft that will remove the virus from your computer.
The 60 second shutdown that this error causes is displayed below
Step One - Race Against Time!
Click on start and select Run
Or
Hold down the Windows key and press R
Step Two - Stop The Shutdown!
Type Shutdown -a then Click Ok.
This will end the count down (System Shutdown Dialog will vanish!)
Now you will need to Download and Install the Microsoft patch, as running the command above did not fix the issue it just temporally disabled the shutdown. Hence why this tutorial is not finished yet.
Step Three - Download The Patch
Download The DCOM/RPC Exploit Patch - MSBLAST Fix! For Windows XP
Once there Click Download
Click on the link above to be redirected to the Micosoft Blaster Fix.
Step Four
Save the File by Clicking Save File
Save to a location you can remember
Step Five
Now Locate the Patch File you have just downloaded and Doulbe Click it
This will then install the patch!
Step Six
Now that you have Installed the Windows XP patch you will need to remove the blaster worm.
This Removal Tool Will Remove:
W32.Blaster.Worm
W32.Blaster.B.Worm
W32.Blaster.C.Worm
W32.Blaster.D.Worm
W32.Blaster.E.Worm
W32.Blaster.F.Worm
Get Blaster Removal Tool From Symantec
Please Note:Before running the removal tool you should
Disable System Restore
once you have run tool and removed the worm you can Re-Enable System Restore
Step Seven
Click Save File.
Save the File to a Location you can remember.
Step Eight
Locate the File you have just downloaded and Double Click it.
Step Nine
Now the Fix Tool has launched, Click Start.
Step Ten
The Fix Tool is now searching for the Blaster worm.
Step Eleven
Once the tool has finished you will receive a dialog box simalir to the one below, yet yours will most lickly say that the worm was found and removed.
Click OK.
I received the image below because I am not infected with the blaster worm.
Blaster Gone!
Thats it you have now patched the exploit on your operating system and you have removed the worm, all there is needed for you to do now is Enable System Restore asuming that you did disable it.
