The computer went into the worm operation

Not much nonsense to go directly to the topic ~ ~ ~ (if it really is a worm virus)

1. Discontinuation of the process

Press the "Ctrl+alt+del" key combination, select the Processes tab in Windows Task Manager, look for "msblast.exe" (or "Teekids.exe", "Penis32.exe"), select it, and then click "End Process" below. Button.

Tip: If you cannot run Windows Task Manager, you can enter cmd in start → Run to open the Command Prompt window and enter the following command "Taskkill.exe/im msblast.exe" (or "taskkill.exe/im Teekids.exe "," Taskkill.exe/im Penis32.exe ").

2. Delete virus body

Click "Start → search" in turn, select "All Files and folders" option, enter the keyword "msblast.exe", set the search target in the operating system partition. After the search is complete, delete the files found in the Search results window. Then use the same method to find and delete the "Teekids.exe" and "Penis32.exe" files.

Tip: In Windows XP systems, you should first disable the System Restore feature by right-clicking My Computer, choosing Properties, and selecting the System Restore tab in System Properties, and checking "Turn off System Restore on all drives".

If you cannot run search, you can enter cmd in start → Run to open the Command Prompt window and enter the following command:

"Del system Letter Winntsystem32msblast.exe" (Windows 2000 System) or "Del system disk Windowssystemmsblast.exe" (Windows XP System)

3. Modify the Registration Form

Click "Start → run", enter "regedit" to open the Registry Editor, locate "Hkey_local_machinesoftware microsoftwindowscurrentversionrun" in turn, and delete "windows Auto Update=msblast.exe "(virus variants may have different display content).

4. Restart your computer

After restarting the computer, the "shockwave" (ie worm virus) virus has been completely removed from the system.

---------to the end of the following is the symptom of worm virus to see if it is a worm-------

Virus type: Worm virus

Object of attack: Windows NT 4.0,windows 2000,windows xp,windows Server 2003

Transmission path: "Shock wave" is a use of Windows system RPC (remote procedure call, is a communication protocol, the program can use this protocol to another computer on the network to request Service) vulnerability, random attack, destructive worm virus. It does not need to be transmitted through e-mail (or attachments), more covert, and less susceptible to detection. It uses IP scanning technology to find computers with Windows 2000/xp/2003 operating systems on the network, and once it finds a vulnerable computer, it uses DCOM (a distributed object model, a protocol that enables software components to communicate directly over the network). RPC buffer vulnerabilities are implanted into the virus body to control and attack the system.

This article from the Internet and the search engine IT Technology blog http://www.guhongtao.com/issued reprint please be sure to indicate