Hi,
My name is Jim.
I would like some help with "W32.BLASTER.WORM",which infected my pc a couple of days ago,like it did to many thousands...
I followed the steps indicated on Symantec's site and i think i managed to deal with the crisis successfully.
Still,i want to make sure,in order to avoid any unpleasant surprises !
1) It's my understanding that the virus came into my system without me downloading anything,but just by being on the internet.Is that correct ?
2) My Norton Antivirus software scanned 2 infected items,both in directory
C:WINDOWS\System 32
One of them was "msblast.exe",mentioned in symantec's directions.
The other was "TFTP812" ;I didn't see this one mentioned anywhere.Is this a file that the virus brought into my computer,or was it an existing system file that got infected ?
3) Is what symantec say in their directions,all that the virus does ?
Is it possible that it has deleted or altered anything else in my system or program files,that i don't know about ?
4) Would you recommend that i use the windows xp "System Restore" function,just to make sure that everything got back to the way it was ?
If i restore my system to an earlier point in time and i check the particular registry value that the virus altered,and it's ok,then that means it's a clean restore point,right ?
Thanks in advance for any help you can give.
This question was answered on June 5, 2004. Much of the information contained herein may have changed since posting.
Symantec's has a removal tool that removes all the changes made by the WORM If you go to: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html it will walk you through downloading and running the removal tool.
Good Luck! Hope I was helpful.
About the author
Posted by Ezequiel of Katharine Gibbs School - New York on June 5, 2004
Need Help with this Issue?
We help people with technology! It's what we do.
Contact or Schedule an Appointment with a location for help!