Blaster Removal ToolFree Blaster detection and removal

W32/Blaster-A can be removed from Windows 95/98/Me and Windows NT/2000/XP/2003 computers automatically with the following removal tool.

Note: When removing variants not listed above, use the removal instructions in the appropriate virus analysis.

Download Blaster Removal Tool

• Download BLASTGUI
• run it
• then click GO.

If you are removing Blaster from several computers, download the removal tool, save it to floppy disk and run it from there.

Command line removal tool

BLASTSFX is a self-extracting archive containing BLASTCLI, a command line removal tool for use by system administrators on Windows networks. Read the notes enclosed in the self-extractor for details on running this program.

Other platforms

To remove W32/Blaster-A on other platforms please follow the instructions for removing worms

 

After removing the worm

After removing the worm you should install the Microsoft patch

W32/Blaster FAQ

1. How do I prevent W32/Blaster-A spreading on my network? 
2. How do I remove W32/Blaster-A manually?
3. Which systems are affected?
4. How did my computer become infected?
5. My computer is continuously rebooting, how can I download RESOLVE?
6. Why am I getting errors associated with SVCHOST.EXE even if my computer is not infected with W32/Blaster-A?
7. Why is InterCheck preventing RESOLVE from running?
8. I am having trouble finding the Microsoft patch. Is there any way of making this easier?

1. How do I prevent W32/Blaster-A spreading on my network?

Network administrators are strongly advised to perform the following operations to limit the impact of the worm:

• Download and deploy Microsoft patch MS03-039 
  W32/Blaster-A exploits a vulnerability that can be patched. To read more about the vulnerability and download the patch for deployment, view Microsoft Security Bulletin MS03-039. On standalone computers, update with all relevant security patches from Windows update.
  Administrators are advised to deploy the patch to internet enabled workstations and internal company networks, paying particular attention to proxy/gateway computers.
• Rename tftp.exe
  The worm utilises tftp.exe, a Windows native program. If tftp.exe exists on your network, and you have no business need for it, rename it (e.g. to tftp-exe.old). You should not delete it as future legitimate software may require it.
• Block traffic to certain ports on your firewall
  Administrators should block incoming traffic on the following ports:
  • tcp/69 (used by the TFTP process)
  • tcp/135 (used by RPC remote access)
  • tcp/4444 (used by this worm to connect)
  This should primarily be implemented on your internet firewall. Where appropriate, you should also block access to these ports to prevent access from potentially infected non-trusted networks.

3. How do I remove W32/Blaster-A manually?

To remove W32/Blaster-A manually on Windows 95/98/Me and Windows NT/2000/XP:

• ensure you have installed Microsoft patch MS03-039 and implemented as many of the steps mentioned above as is feasible.
• press Ctrl+Alt+Del
• in Windows NT/2000/XP click Task Manager and select the Processes tab
• look for a process named msblast.exe in the list
• click the process to highlight it
• click the 'End Process' (in Windows 95/98/Me 'End Task') button
• close Task Manager.

Search for the file msblast.exe in the Windows system folder (usually a subfolder of Windows or WINNT) and delete it.

In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

• At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
• Before you edit the registry, you should make a backup. If in doubt, contact your network administrator. Incorrect editing of the Windows Registry can cause system failure.
• Locate the HKEY_LOCAL_MACHINE entry:

  HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  in the righthand pane select

  windows auto update = msblast.exe

  and delete it if it exists.
• Close the registry editor.

You should reboot your computer and repeat the above process to ensure all traces of the worm have been removed from your system.

If you have any problems removing W32/Blaster-A after following these instructions, please contact technical support.

To remove W32/Blaster-A on other platforms please follow the instructions for removing worms

4. W?hich systems are affected

• Windows NT/2000/XP computers are vulnerable.
• Windows 95/98/Me computers can become infected if a W32/Blaster-A file is run manually.
• Apple-based workstations, Unix and other platforms (including PDAs and games consoles) cannot be infected with W32/Blaster-A.

If a W32/Blaster-A file is found on a computer, it has been dropped there by an infected computer, or it has been executed locally.

5. How did my computer become infected?

W32/Blaster-A scans the internet and local networks looking for computers vulnerable to Microsoft's DCOM RPC security exploit. When it finds one it causes the remote computer to use TFTP to download a copy of the worm. This is saved as msblast.exe in the Windows system folder and the registry on that computer is changed so that the worm will be run when the computer restarts.

6. My computer is continuously rebooting, how can I download RESOLVE?

Often when a computer is infected with W32/Blaster-A it restarts every few minutes, usually with a message similar to "Windows must now restart because the Remote Procedure Call (RPC) Terminated Unexpectedly". This prevents the required patches and files from being downloaded.

To stop this on Windows XP, select Start|Run, then type:

shutdown -a

to abort the shutdown. You will then be able to disinfect automatically or manually as described above.

Where possible, download the RESOLVE W32/Blaster-A self-extractor on another computer. Save it to floppy disk and run the self-extractor on the affected computer.

If you cannot download on another computer, disable Distributed COM to prevent this rebooting.

Windows XP

• Select Start|Run and type

  dcomcnfg.exe.

• Select Console Root|Component services.
• Open the Computers subfolder.
• Right-click on My Computer|Properties.
• Click the Default Properties tab.
• Deselect 'Enable distributed COM', click Apply then click OK.
• Restart the computer.

Set the options back to normal after applying relevant patches and IDEs.

Windows NT/2000

• Select Start|Run and type

  dcomcnfg.exe.

• Select the Default Properties tab.
• Deselect 'Enable distributed COM on this computer', click Apply then click OK.
• Restart the computer.

Set the options back to normal after applying relevant patches and IDEs.

Windows 95/98/Me

Clean boot or go into DOS Mode (Windows 95/98) and use SWEEP with the W32/Blaster-A IDE to disinfect.

Use a firewall or disable 'File and print sharing' to protect the computer from further infection.

 

7. Why am I getting errors associated with SVCHOST.EXE even if my computer is not infected with W32/Blaster-A?

If a vulnerable computer is probed by W32/Blaster-A, even if infection is not successful, the svchost service will fail. This will cause a variety of problems with other software.

To recover from these problems install the patch at Microsoft Security Bulletin MS03-039 and restart the svchost service.

8. Why is InterCheck preventing RESOLVE from running?

The InterCheck client will prevent the RESOLVE disinfector from accessing worm files if the W32/Blaster-A IDE has been installed.

On Windows NT/2000/XP:

• log in as local administrator
• at the taskbar, select Start|Programs|Sophos Anti-Virus
• select the IC Client tabbed page
• click STOP
• run RESOLVE
• after you have removed the worm, in the IC Client tabbed page click GO.

On Windows 95/98/Me:

• rename the W32/Blaster-A IDE (BLASTERA.IDE) to BLASTERA.TXT
• reboot the computer locally (press Escape if asked to log in)
• run RESOLVE
• after removing the worm, change the IDE name back to BLASTERA.IDE and reboot again.

 

9. I am having trouble finding the Microsoft patch. Is there any way of making this easier?

Provided you have administrator status on your computer you can download patches from Windows Updateinstead.

Windows Update will query your computer and will tell you which patches it considers you should use. Those marked Critical Update are the most important. The reference number of the patch for the vulnerability exploited by W32/Blaster-A is 823980.

If you are using an old version of Internet Explorer, the recommended download may be huge. If your internet link is slow, you may find it easier to upgrade Internet Explorer from a computer magazine CD first, and then use Windows Update.

Note: Windows Update only works in conjunction with Internet Explorer 5 and higher.