Blaster Worm

  • Thread starter Thread starter Colm
  • Start date Start date
C

Colm

I have dowloaded the patch from microsofts web site and
installed it but norton Anti virus still displays a error
message that the virus is still on the computer ?
 
Your Norton Anti-virus should be able to tell you where
it is.

If not try this at your risk: My Computer------Double
click Drive-----Windows-----System 32-----mBlast.exe
When you find it delete it. If it goes to your recycle
bin delete it there too.
You really need to go into your registery and delete all
signs of it there too, it is easy but scares people.
If you have a techie friend beg a favour!
Otherwise, if you take the risk Start----Run,
write "regedit"(without the inverted commas) ---- click
edit----Find---Write "mblast" (no commas) ----Click Find
Next---then delete each mBlast you find. Keep
pressing "Find Next" until the whole registery is cleaned.

Good Luck
 
The patch does not remove the worm, it prevents
re-infection.
You must remove the worm with a tool from Norton or McAfee.
Check www.sarc.com
or http://vil.nai.com/vil/averttools.asp I like the
STINGER tool from NAI because it will scan for and remove a
whole bunch of viruses, the Norton tools from SARC are one
virus at a time.

BE SURE TO READ the instructions given on the appropriate
web site, especially about NT/XP because you will need to
take care of the viruses in system restore.

You must run a firewall, you must apply the MS patches and
you must run an up to date anti-virus.


| I have dowloaded the patch from microsofts web site and
| installed it but norton Anti virus still displays a error
| message that the virus is still on the computer ?
 
There was an article by the Toronto star about how you
have to remove it first then patch, but I cannot seem to
find it in their archives. I scanned it so if you would
like I can email it if you like. Email me if you want it.
 
First, stop the bug from running by hitting CTRL-ALT-DELETE and
bringing up the task manager. Look for msblast.exe in the list, and
kill it. Now your computer won't shut down, but the bug is still there
and will run the next time you start your machine. Go to this URL to
find out how to get rid of it:
<http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.re
moval.tool.html>







See www.kellys-korner-xp.com/xp_qr.htm#rpc
<http://www.kellys-korner-xp.com/xp_qr.htm> for a quick removal tool for the
MSBlast worm and a link to the Microsoft patch to prevent future infection.
Then update your antivirus software and scan your system.
 
Greetings --

Installing the patch Microsoft provides will preclude your
becoming re-infected with the worm, but it isn't intended to "heal"
already infected machines.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Back
Top