Virus W32.Blaster.Worm is one of the largest wide distributed worms on Windows PC. Before we move towards W32/Blaster.Worm Removal Guide for Windows users, let look into the virus details, mechanism and symptoms.

Virus W32/Blaster.Worm Removal Guide for Windows Vista Users

W32/Blaster.Worm is basically a class viruses, first discovered in August 2003. The Blaster Virus infects by exploiting Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205). The original bug in Microsoft Windows has already been fixed through a patch for Microsoft Windows Virus alert about the Blaster worm variants. Here are the other W32/Blaster.Worm variants:
  • W32.Blaster.A.Worm
  • W32.Blaster.B.Worm
  • W32.Blaster.C.Worm
  • W32.Blaster.D.Worm
  • W32.Blaster.E.Worm
  • W32.Blaster.F.Worm

How does Virus W32/Blaster.Worm infects Windows Computers

W32/Blaster.Worm is basically a virus first discovered in August 2003. The Blaster Virus infects by exploiting Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205). The original bug in Microsoft Windows has already been fixed through Virus alert about the Blaster worm and its variants patch.

The W32/Blaster computer viruses target machines that run Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Windows Vista and Microsoft Windows 7 operating systems. Blaster worms can not infect Apple Mac, Unix, Linux and other computer platforms because that security bug is Microsoft Windows specific.

W32/Blaster worms hijack a copy of the file msblast.exe, penis32.exe, teekids.exe, mspatch.exe, mslaugh.exe or enbiei.exe from the host that infected the computer. Downloaded file is saved in the Windows system folder. The infected PC then look for the more vulnerable infectable computers, through internet and local networks.

What are the Symptoms and Actions of W32/Blaster.Worm Virus

W32.Blaster.Worm class of viruses opens the backdoors of a compromised computer and spreads through attached removable media devices as well. Blaster worm worms are very dangerous at the point they are able to isolate themselves to avoid and resist any attempt of W32/Blaster.Worm Removal by analysis of the system. W32.Blaster virus is usually spread through programs used in the network topology of peer-to-peer such as games, music, videos, attachments in emails, etc. Once into the system, a W32.Blaster virus is capable of sorting and storing all activities on the host computer, making the machine slow and steeling the user privacy data.

W32.Blaster.Worm virus issues totally fake security threat messages and virus alerts by its so called "Privacy Protection" on infected computers. This rogue program also issue other deceptive security alerts, notices and warnings tells Windows user about the following fake threats to be allegedly identified by it:
  • Backdoor.Win32.Scrab.p
  • W32.Blaster.Worm
  • Email-Worm.Brontok
  • TrojanDownloader:Win32/Bredolab.X
  • Mal/Generic-A, Trojan.Agent
Note: For Microsoft Windows XP users, virus W32.Blaster.Worm can cause the additional trouble by remote RPC service to terminate displaying a message "Windows must now restart because the Remote Procedure Call (RPC) Terminated Unexpectedly". As a results the infected computer restarts every few minutes automatically.
Virus W32/Blaster.Worm Removal Guide for Windows Vista Users
Note: If you are getting this security notification in your windows taskbar given below, instead original W32/Blaster.Worm your Windows PC is infected with a fake antivirus called "Internet Security 2012 Virus/Malware". To clean your computer for this rogue program, please check our Internet Security 2012 Virus/Malware Removal Tools for Windows Users.
Virus W32/Blaster.Worm Removal Guide for Windows Vista Users

Virus W32/Blaster.Worm Removal Guide for Windows Users

However, if its not the case and your computer is really infected with the W32/Blaster.Worm, please follow this W32/Blaster.Worm Removal Guide for Windows Vista Users here under:

1) Select Start -> Run (or press WinKey+R)
2) Type in: shutdown -a
3) Click OK or press Enter.

Virus W32/Blaster.Worm Removal Guide for Windows Vista Users

4) Download and install Microsoft patch MS03-039.
5) Then run W32.Blaster.Worm Removal Tool. You can choose one of these:
6) Restart the computer and re-connect to the internet. You should run Blaster Worm Removal Tool again to ensure that your computer is clean.
7) Download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove this worm from your computer.

The worm can download additional malware onto your computer. We have to make sure that your computer is not infected with other malicious software, specifically trojan downloaders.

W32/Blaster.Worm Virus Removal Manual Guide

1) Download and install Microsoft patch MS03-039.
2) Open Windows Task Manager by pressing [Ctrl+Alt+Delete]
3) Click on the Processes tab.
4) Find process(es) named msblast.exe, penis32.exe, teekids.exe, mspatch.exe, mslaugh.exe, enbiei.exe
5) Click these process(es) and then click the End Process button. Close Task Manager.
6) Open Windows Registry Editor (click Start -> Run. Type Regedit and click OK or press Enter).
7) Locate the HKLM\Software\Microsoft\Windows\CurrentVersion\Run entry.
8) In the right hand pane select windows auto update = msblast.exe and delete it.
9) Restart the computer and re-connect to the internet.
10) Download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove this worm from your computer.

The worm can download additional malware onto your computer. We have to make sure that your computer is not infected with other malicious software, specifically trojan downloaders.

W32/Blaster.Worm Registry Values and Associated Files

Here under are the W32/Blaster.Worm Registry Values:
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    "windows auto update"="msblast.exe"
And the list of all associated files is given below:
  • C:\Windows\System32\msblast.exe
  • C:\Windows\System32\penis32.exe
  • C:\Windows\System32\teekids.exe
  • C:\Windows\System32\mspatch.exe
  • C:\Windows\System32\mslaugh.exe
  • C:\Windows\System32\enbiei.exe

Post a Comment

The editors reserve the right to edit/remove any comments that are abusive, offensive, contain profanity, serves as spam or attempting to harbor irrelevant text links for any purpose. Please read our Comments Policy for details.

 
Top