The computer went into the worm operation

Source: Internet
Author: User
Tags object model

Not much nonsense to go directly to the topic ~ ~ ~ (if it really is a worm virus)

1. Discontinuation of the process

Press the "Ctrl+alt+del" key combination, select the Processes tab in Windows Task Manager, look for "msblast.exe" (or "Teekids.exe", "Penis32.exe"), select it, and then click "End Process" below. Button.

Tip: If you cannot run Windows Task Manager, you can enter cmd in start → Run to open the Command Prompt window and enter the following command "Taskkill.exe/im msblast.exe" (or "taskkill.exe/im Teekids.exe "," Taskkill.exe/im Penis32.exe ").

2. Delete virus body

Click "Start → search" in turn, select "All Files and folders" option, enter the keyword "msblast.exe", set the search target in the operating system partition. After the search is complete, delete the files found in the Search results window. Then use the same method to find and delete the "Teekids.exe" and "Penis32.exe" files.

Tip: In Windows XP systems, you should first disable the System Restore feature by right-clicking My Computer, choosing Properties, and selecting the System Restore tab in System Properties, and checking "Turn off System Restore on all drives".

If you cannot run search, you can enter cmd in start → Run to open the Command Prompt window and enter the following command:

"Del system Letter Winntsystem32msblast.exe" (Windows 2000 System) or "Del system disk Windowssystemmsblast.exe" (Windows XP System)

3. Modify the Registration Form

Click "Start → run", enter "regedit" to open the Registry Editor, locate "Hkey_local_machinesoftware microsoftwindowscurrentversionrun" in turn, and delete "windows Auto Update=msblast.exe "(virus variants may have different display content).

4. Restart your computer

After restarting the computer, the "shockwave" (ie worm virus) virus has been completely removed from the system.

---------to the end of the following is the symptom of worm virus to see if it is a worm-------

Virus type: Worm virus

Object of attack: Windows NT 4.0,windows 2000,windows xp,windows Server 2003

Transmission path: "Shock wave" is a use of Windows system RPC (remote procedure call, is a communication protocol, the program can use this protocol to another computer on the network to request Service) vulnerability, random attack, destructive worm virus. It does not need to be transmitted through e-mail (or attachments), more covert, and less susceptible to detection. It uses IP scanning technology to find computers with Windows 2000/xp/2003 operating systems on the network, and once it finds a vulnerable computer, it uses DCOM (a distributed object model, a protocol that enables software components to communicate directly over the network). RPC buffer vulnerabilities are implanted into the virus body to control and attack the system.

This article from the Internet and the search engine IT Technology blog reprint please be sure to indicate

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.