Comments: Worms are common computer viruses. It uses the network for replication and transmission, and the transmission path is through the network and email. A worm is a self-contained Program (or a set of programs) that can spread copies of its own functions or some part of it to its worm.
In his computer system (usually through a network connection ). Note that unlike general viruses, worms do not need to attach themselves to the Host Program. There are two types of worms: Host worms and Network Worms. The primary computer worms are completely contained in the computers on which they run, and only copy themselves to other computers using network connections, after a master computer worm adds its own copy to another host, it terminates itself (so there is only one copy of the worm running at any given moment ), this worm is also called "hares". Generally, it is spread through a port 1434 vulnerability.
-------- Below are the symptoms of the worm to see if it is a worm -------
Virus Type: Worm
Target customers: Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003
Transmission path: "Shock Wave" is a communication protocol that uses Windows RPC (Remote process call, programs can use this Protocol to request services from programs on another computer in the network.) Vulnerabilities spread, attack at random, and cause high damage to worms. It does not need to be transmitted via email (or attachments), which is more concealed and imperceptible. It uses IP scanning technology to find computers with Windows 2000/XP/2003 operating systems on the network. Once a computer with a vulnerability is found, it uses DCOM (distributed object model, A protocol that enables software components to communicate directly through the network.) RPC buffer vulnerabilities are embedded into viruses to control and attack the system.
If it is a worm, perform the following operations:
1. Stop the process
Press Ctrl + Alt + Del in "Windows Firewall"), select it, and click the "End Process" button below.
Tip: if you cannot run "Windows images/im msblasst.exe((or ~taskkill.exe/im teekids.exe?~~taskkill.exe/im penis32.exe ").
2. delete a virus
Click "Start Time" on the next page to search for all files and folders, and enter the key word "msblast.exe". The search target is located in the partition of the operating system. After the search is complete, delete all the files in the search results window. Find and delete the deleteekids.exeworkflow and penis32.exe files in the same region.
Tip: in Windows XP, the "System Restore" function should be disabled first by right-clicking "my computer" and selecting "properties ", in System Properties, select the System Restore tab and select disable System Restore on all drives.
If you cannot run "Search", enter "cmd" in "Start> Run" to open the "command prompt" window and enter the following command:
"Del system disc winntsystem32msblast.exe" (Windows 2000 )))or “del windowwindowssystemmsblast.exe "(Windows XP system)
3. Modify the Registry
Click Start> Run, enter regedit to open registry editor, and find HKEY_LOCAL_MACHINESOFTWARE MicrosoftWindowsCurrentVersionRun ", delete "windows auto update‑msblast.exe" (the Virus Variant may have different display content ).
4. restart the computer
After the computer is restarted, the "Shock Wave" (that is, the worm virus) virus has been completely cleared from the system.