The MSBLAST.A worm infects machines via network connections. It can attack entire networks of computers or one single computer connected to the Internet. The worm exploits a known windows vulnerability that is easily patched, however few systems seem to have this patch installed. It attacks Windows 2000 and Windows XP machines and exploits the DCOM RPC Vulnerablity.  Depending on the system date it will start a Denial of Service attack against windowsupdate.com, this makes it difficult to download the needed patches and allow the worm to infect as many machines as it can before being disabled. However, as of August 15th, Microsoft decided to kill the windowsupdate.com domain to lessen the impact from this denial of service attack. MSBLAST can also cause widespread system instability including but not limited to Windows Blue screens, out of memory errors, changes to Control Panel, inability to use functions in browser, and many more oddities. Download the Windows patches for this vulnerability by clicking on the links below:
Windows 2000: DCOM/RPC Exploit patch
Windows XP: DCOM/RPC Exploit patch
These Windows vulnerabilities are patched by using Windows Update to

 download all the critical updates for your system. However in some cases, people have reported getting an error 0x800A138F when trying to download updates. If you are receiving an error similar to this, read Marc Liron's excellent article about solving this at his updatexp.com website.
What is the DCOM Vulnerability?
he DCOM vulnerability in Windows 2000 and XP can allow an attacker to remotely compromise a computer running Microsoft® Windows® and gain complete control over it. The worm causes a buffer overrun in the Remote Procedure Call (RPC) service. When this service is terminated the virus infects the machine and then tries to infect other machines.
What are the Symptoms of the MSBLAST worm?
You'll see a screen similar to the one below when you are infected, this will countdown to zero and literally shut down the system completely. The warning will state "This shutdown was initiated by NT AUTHORITY\SYSTEM". The message will read
Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly.
You can disable this shutdown by following the steps below during the countdown
1. Click on Start, Run
2. Type in CMD and press ENTER
3. Type in the following command and press Enter
SHUTDOWN -A
This will terminate the shutdown, however in most cases the system may be to unstable to try to recover and may need to be rebooted anyway
How Does MSBLAST Infect My Computer?
1. The worm creates a Mutex named "BILLY." If the mutex exists, the worm will exit.
2. Adds the value:
windows auto update" = MSBLAST.EXE (variant A)
windows auto update" = PENIS32.EXE (variant B)
Microsoft Inet xp.." = TEEKIDS.EXE (variant C)
"Nonton Antivirus=mspatch.exe" (variant E)
"Windows Automation" = "mslaugh.exe" (variant F)
"www.hidro.4t.com"="enbiei.exe" (variant G)  to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the worm runs when you start Windows.
3. Calculates the IP address, based on the following algorithm, 40% of the time:Host IP: A.B.C.D sets D equal to 0.if C > 20, will subtract a random value less than 20.Once calculated, the worm will start attempting to exploit the computer based on A.B.C.0, and then count up.