How to remove W32.BLASTER.WORM



My name is Jim.

I would like some help with "W32.BLASTER.WORM",which infected my pc a couple of days ago,like it did to many thousands...

I followed the steps indicated on Symantec's site and i think i managed to deal with the crisis successfully.

Still,i want to make sure,in order to avoid any unpleasant surprises !

1) It's my understanding that the virus came into my system without me downloading anything,but just by being on the internet.Is that correct ?

2) My Norton Antivirus software scanned 2 infected items,both in directory

C:WINDOWS\System 32

One of them was "msblast.exe",mentioned in symantec's directions.

The other was "TFTP812" ;I didn't see this one mentioned anywhere.Is this a file that the virus brought into my computer,or was it an existing system file that got infected ?

3) Is what symantec say in their directions,all that the virus does ?

Is it possible that it has deleted or altered anything else in my system or program files,that i don't know about ?

4) Would you recommend that i use the windows xp "System Restore" function,just to make sure that everything got back to the way it was ?

If i restore my system to an earlier point in time and i check the particular registry value that the virus altered,and it's ok,then that means it's a clean restore point,right ?

Thanks in advance for any help you can give.


This question was answered on June 5, 2004. Much of the information contained herein may have changed since posting.

Symantec's has a removal tool that removes all the changes made by the WORM If you go to: it will walk you through downloading and running the removal tool.

Good Luck! Hope I was helpful.

Need Help with this Issue?

We help people with technology! It's what we do.
Schedule an Appointment with a location for help!


Posted by Ezequiel of Katharine Gibbs School - New York on June 5, 2004