Side Effects
Although the worm can only spread on systems running Windows 2000 or Windows XP (32 bit) it can cause instability in the RPC service on systems running Windows NT, Windows XP (64 bit), and Windows Server 2003. In particular, the worm does not spread in Windows Server 2003 because it was compiled with the /GS switch, which detected the buffer overflow and shut the RPCSS process down.When infection occurs, buffer overflow makes RPC service crash, leading Windows to display the following message and then automatically reboot, usually after 60 seconds. (default RPC service failure behaviour)
| “ | System Shutdown:
This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM Time before shutdown: hh:mm:ss Message: Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly. |
” |
This was the first indication many users had an infection; it often occurred a few minutes after every startup on compromised machines. A simple resolution to stop countdown is to run the "shutdown -a" command in the Windows command line, causing some side effects such as an empty (without users) Welcome Screen. The Welchia worm had a similar effect. No more than a year later, the Sasser worm surfaced, which caused a similar message to appear.
Read more about this topic: Blaster (computer Worm)
Famous quotes related to side effects:
“I’m not a military man, Captain. War holds no romance for me. The side effects are repulsive.”
—Richard Bluel, and Henry Hathaway. Major Hugh Tarkington (Clinton Greyn)