Taken from Cert.org's page found here:
http://www.cert.org/tech_tips/w32_blaster.html
First, you must stop the system from shutting down automatically. To do this,
1. In Windows, click on START, then RUN
2. Type: Shutdown -A
* don't forget to include the - before the A
3. Click OK.
Then, you will need to remove the virus from the system so that you can update Windows.
1. If the machine is connected to a network, disconnect it from the network to prevent other computers on the network from getting infected.
2. The MSBLAST worm will prevent you from accessing windows update. So, stop the worm by using the WindowsTask Manager. The worm may show up as "msblast.exe", "teekids.exe", or "penis32.exe".
a. Press Ctrl-Alt-Delete key combination
b. Click "Task Manager" button
c. Select "Processes" tab
d. Cick once on "msblast.exe"
e. Click "End Process" button, answer "Yes" to warning dialog
f. Repeat previous two steps for "teekids.exe", and "penis32.exe"
3. To remove the virus so it does not reinfect the system, search for and delete any files named "msblast.exe", "teekids.exe", or "penis32.exe":
a. Click on the Start Menu -> Search -> Find Files or Folders
b. Search for "msblast.exe", and delete any matches
c. Right-click each file and delete it
d. Repeat previous two steps for "teekids.exe", and "penis32.exe"
4. Update Windows to prevent reinfection: http://www.update.microsoft.com
My computer has been infected with the WORM_MSBLAST.A virus and it is constantly shutting down when I start Windows. How do I remove the virus? (KB002130)
Modified on: Wed, Jun 29, 2016 at 4:42 PM
Did you find it helpful? Yes No
Can you please tell us how we can improve this article?