How to remove W32.BLASTER.WORM

Question

Hi,

My name is Jim.

I would like some help with "W32.BLASTER.WORM",which infected my pc a couple of days ago,like it did to many thousands...

I followed the steps indicated on Symantec's site and i think i managed to deal with the crisis successfully.

Still,i want to make sure,in order to avoid any unpleasant surprises !

1) It's my understanding that the virus came into my system without me downloading anything,but just by being on the internet.Is that correct ?

2) My Norton Antivirus software scanned 2 infected items,both in directory

C:WINDOWS\System 32

One of them was "msblast.exe",mentioned in symantec's directions.

The other was "TFTP812" ;I didn't see this one mentioned anywhere.Is this a file that the virus brought into my computer,or was it an existing system file that got infected ?

3) Is what symantec say in their directions,all that the virus does ?

Is it possible that it has deleted or altered anything else in my system or program files,that i don't know about ?

4) Would you recommend that i use the windows xp "System Restore" function,just to make sure that everything got back to the way it was ?

If i restore my system to an earlier point in time and i check the particular registry value that the virus altered,and it's ok,then that means it's a clean restore point,right ?

Thanks in advance for any help you can give.

Answer

This question was answered on June 5, 2004. Much of the information contained herein may have changed since posting.

Symantec's has a removal tool that removes all the changes made by the WORM If you go to: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html it will walk you through downloading and running the removal tool.

Good Luck! Hope I was helpful.

Need Help with this Issue?

We help people with technology! It's what we do.
Schedule an Appointment with a location for help!

Author

Posted by Ezequiel of Katharine Gibbs School - New York on June 5, 2004