"Blaster" Worm
Information
You should print
this page as a reference while you are removing
this virus
Information
regarding "Blaster" from Symantec
Instructions on How to Protect and Clean Your System
If you are running Windows 2000 or Windows XP, you
are vulnerable to this virus.
If you have not yet patched your system, you should
do so now. Click on the proper file below, and select
"Open" in the dialogue box.
Windows 2000 Patch
Windows XP Patch
If You are infected or suspect that you are please
follow these removal instructions
If your system is continually rebooting (randomly
powering off) please follow the steps below to remove
this virus.
1. To start your computer in Safe Mode:
a. Shut down your computer. Turn it back on again,
and hold down the F8 key while your system starts.
b. When prompted, select Safe Mode and press enter
(do not select Safe Mode With Networking)
c. If prompted, select the Operating System displayed
(default Operating System should be highlighted).
2. To disable the virus from starting
automatically:
a. Click on the Start button and select Run
b. In the Run prompt, type regedit and press enter
c. Click on the plus sign (+) next to HKEY_LOCAL_MACHINE.
Then, click on the plus sign next to Software. Click
on the plus sign next to Microsoft. Again, click on
the plus sign next to Windows. Click on the plus sign
next to CurrentVersion. In the CurrentVersion list,
click on the word Run.
d. Look for msblast.exe, so that it is highlighted,
and hit the delete key on your keyboard.
e. Select Yes to confirm deletion choice.
f. Exit the Registry editor (click the X in the upper
right hand corner).
3. Restart your computer (but
this time in "normal" mode
- not Safe Mode).
4. Download the following fix file from Symantec
Blaster Remover
a. After the file has saved to your desktop, select
Open on the Download Complete window. This will launch
the Symantec W32.Blaster.Worm.Fix Tool
b. Click the Start button displayed on the Symantec
W32.Blaster.Worm.Fix Tool. The tool will begin analyzing
your files and folders for the worm and may take several
minutes to complete.
c. When it has finished, you will be prompted with
a window to install a patch that will protect your
system from this and similar vulnerabilities. Click
Yes to go to the Microsoft site directly.
5. Download the Microsoft patch
Windows 2000 Patch
Windows XP Patch
a. Choose open from this location
b. Confirm security warning pop-up by clicking Yes
c. Follow pop-up instructions and reboot by clicking
Finish
--------------------------------------------------------------------------------
If your system is not booting properly, and
you believe you have the worm, please follow these
steps:
1. You need to identify and terminate the
worm running on your system.
a. Press and hold down the following keys: Control,
Alt and Delete
b. Click the Task Manager button
c. Select the Processes tab
d. Click the Image Name column to sort the list in
alphabetical order
e. Look for msblast.exe under the Image Name column
f. Select the msblast.exe file by clicking on itonce.
Then, click the End Process button.
g. Now you can close the Windows Task Manager screen
by clicking the X in the upper right hand corner.
2. Download the following
fix file from Symantec
Blaster
Remover
a.
After the file has saved to your desktop, select
Open on the Download Complete window. This will launch
the Symantec W32.Blaster.Worm.Fix Tool
b. Click the Start button displayed on the Symantec
W32.Blaster.Worm.Fix Tool. The tool will begin analyzing
your files and folders for the worm and may take several
minutes to complete.
c. When it has finished, you will be prompted with
a window to install a patch that will protect your
system from this and similar vulnerabilitys. Click
Yes to go to the Microsoft site directly.
3. Download the Microsoft patch
Windows 2000 Patch
Windows XP Patch
a. Choose Open from this location
b. Confirm security warning pop-up by clicking Yes
c. Follow pop-up instructions and reboot by clicking
Finish
