Home

How to remove the MSBlaster (W32/Lovsan.worm) virus

These instructions are assuming you are running Windows XP (If you are running Windows 2000, contact the Help Desk). We suggest that you print out a copy of these instructions before attempting to clean your system.

This particular virus inserts itself by connecting directly to your computer and exploiting a problem with Microsoft's software. By enabling the XP firewall, we can block the virus from re-entering your system through that security hole. Doing so should give you enough time to remove the virus, and install the update that will prevent it from coming back.

1) Enable the Windows XP firewall

If you have a BCPL icon on your desktop, double click it; otherwise, perform the following steps:
- Click the Start button in the lower left-hand corner.
- If you see two columns, click Control Panel.
- If only one column appears, click Settings, and then click Control Panel.
- The Control Panel should now appear. If you see the phrase Pick a category in the window, click Switch to Classic View on the left.
- Double click Network Connections.
- Double click the BCPL icon.
Instead of dialing normally, click the Properties button at the bottom.
Click the Advanced tab at the top.
At the top of your next screen, make sure there is a check next to Protect my computer and network ....
Click OK until you are returned to your desktop.

2) Check for and remove MSBlaster virus

Run the free "Stinger" utility (version 1.8.0 or newer) from the Network Associates website at http://vil.nai.com/vil/stinger/. Stinger is produced by the McAfee AVERT division of Network Associates, the makers of McAfee Virus Scan. It will remove MSBlaster and a number of other recent worms, trojans, and viruses. Read the instructions on the Stinger web page carefully, then download Stinger from the website and run it on your PC.
Note: Stinger downloads from the Network Associates web site have been very slow today, probably due to a huge number of people trying to download the latest version of Stinger. You can also download it from the following URL on the BCPL.NET web site, but go to the official Stinger URL above for instructions: www.bcpl.net/download/stng259.exe

3) Close the Microsoft security vulnerability that let the virus infect your system.

Visit http://www.windowsupdate.microsoft.com
You will need to download all of the updates from the "Critical Update" section.

If you have any difficulties with these instructions, or if you have any other problems, please contact the Help Desk at 410-887-3297 or