Editing Blaster (computer worm) (section)

== Side effects ==

Although the worm can only spread on systems running [[Windows 2000]] or [[Windows XP]], it can cause instability in the [[Remote procedure call|RPC]] service on systems running other versions of [[Windows NT]], including [[Windows Server 2003]] and [[Windows XP Professional x64 Edition]]. In particular, the worm does not spread in Windows Server 2003 because Windows Server 2003 was compiled with the /GS switch, which detected the buffer overflow and shut the RPCSS process down.<ref>{{cite web |url=https://blogs.msdn.microsoft.com/michael_howard/2004/05/23/why-blaster-did-not-infect-windows-server-2003/ |title=Why Blaster did not infect Windows Server 2003 |publisher=Microsoft Corporation |work=Microsoft Developer |first=Michael |last=Howard |date=2004-05-23 |access-date=2018-11-03}}</ref>

When infection occurs, the buffer overflow causes the RPC service to crash, leading Windows to display the following message and then automatically reboot, usually after 60 seconds.<ref>{{cite web |url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_msblast.a |title=Worm_MSBlast.A |publisher=TrendMicro.com |access-date=2018-11-03}}</ref>

{{cquote|1=System Shutdown:

This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: hours:minutes:seconds

Message:

Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly.
}}

This was the first indication many users had an infection; it often occurred a few minutes after every startup on compromised machines. A simple resolution to stop countdown is to run the "shutdown /a" command,<ref>{{cite web |url=http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&docname=c00035757&lc=en |title=Blaster Worm-Virus or Its Variants Cause the Computer to Shutdown with an NT AUTHORITY\SYSTEM Error Message Regarding Remote Procedure Call (RPC) Service |publisher=[[Hewlett-Packard|HP]] |work=HP Consumer Support |url-status=dead |archive-url=https://web.archive.org/web/20141110185841/http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&docname=c00035757&lc=en |archive-date=2014-11-10 |access-date=2018-11-03}}</ref> causing some side effects such as an empty (without users) Welcome Screen.<ref>{{cite web |title=Blaster Worm |date=6 September 2011 |url=https://www.techopedia.com/definition/27295/blaster-worm |publisher=Techopedia |access-date=2018-11-03}}</ref>  The [[Welchia]] worm had a similar effect. Months later, the [[Sasser (computer worm)|Sasser worm]] surfaced, which caused a similar message to appear.