• Comments (0)
• Report
• Tell a Friend
• Print
• Screenshots

Symantec Security Response developed a removal tool to clean the W32.Blaster.Worm infections.

Features of W32.Blaster.Worm Removal Tool 1.0.6.1:

· terminates the W32.Blaster.Worm viral processes.
· deletes the W32.Blaster.Worm files.
· deletes the dropped files.
· deletes the registry values that have been added.

Important notes:
· W32.Blaster.Worm exploits the DCOM RPC vulnerability. This is described in Microsoft Security Bulletin MS03-026, and a patch is available there. You must download and install the patch. In many cases, you will need to do this before continuing with the removal instructions. If you are not able to remove the infection or prevent re-infection using the following instructions, first download and install the patch.
· Additional information, and an alternate site from which to download the Microsoft patch is available in the Microsoft article What You Should Know About the Blaster Worm and Its Variants.
· Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. It has been reported that, for users of Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This may also work with other firewalls, although this has not been confirmed.