This page describes the MSBlaster worm/virus and provides instructions for its removal.

NOTE: This Virus does NOT infect Windows 95, 98 or ME machines.

If you are not running anti-virus software or do not have the most current virus definitions for your anti-virus software, you may possibly have a virus on your system and are not aware of it. Mediacom Online advises that you use updating anti-virus software and a software firewall on your system to help prevent contamination of your personal computer.

Characteristics of the Virus

W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm targets only Windows 2000 and Windows XP machines. While Windows NT and Windows 2003 Server machines are vulnerable to the aforementioned exploit (if not properly patched), the worm is not coded to replicate to those systems. This worm attempts to download the msblast.exe file to the %WinDir%\system32 directory and then execute it. W32.Blaster.Worm does not have a mass-mailing functionality.

Download the latest patches

If you are using Microsoft ® Windows NT® 4.0, Windows® 2000, Windows XP, or Windows Server™ 2003, you should follow the steps here, on Microsoft's site to help protect your computer and to recover if your computer has been infected.

Prevention of the Virus

Keeping your operating system and applications up-to-date with the latest anti-virus definitions, and operating system security patches can help protect your system from most attacks and can also help stop the propagation of certain worms and security threats.

Perform the steps in the following sections to help prevent infection:




• Update your anti-virus program regularly and configure it for automatic updates if available.



• Keep a current anti-virus program installed and protection enabled at all times.



• Keep a software firewall running on your system to prevent unwanted intrusions.



• Use Windows Update to install any security updates available.
  
  To install security updates, click the link below and install the security updates listed under Critical Updates.


http://windowsupdate.microsoft.com


• Disable the Preview Pane in Outlook or Outlook Express from the View menu.



• Do not open unexpected files received by e-mail or chat.



• Password protect shared network drives if you have networked computers. The virus will try to create copies of itself on network drives every 30 minutes.



• Disconnect infected computers from a local area network (LAN) to avoid infecting your other computers.