Blaster Worm Damage

[dwarner]

I have the following residual side effects of the recent
Blaster Worm. Any ideas on how I can fix these problems?


1) Task Manager and REGEDT32 can Open but they close
immediately, so I can't get in to see if there is still
some part of Blaster running.
2) I keep getting multiple Explorer Notices that overlay
each other, all saying the same thing: " Explorer X
Windows Socket Error: Only one usage of each socket
address (protocol/network address/port) is normally
permitted (10048), on API "Bind"."
One of these notices on some specified time interval (15
seconds I think, I'm not sure), but all applications can
still run over them. When I do a CNTL+ALT+TAB to list
the open applications all these open Explorer notices
show up as one Explorer Icon.



Any ideas on how I can repair these problems

 

[Steve Nielsen]

I have seen such "residuals" when the worm was cleaned 1st and then the
patch installed (it should be done the other way around; patch first,
then clean). Between the time it's cleaned and the patch installs the
system gets re-infected. Get the fixblast.exe file from Symantec and
clean it up again.

Steve