I just downloaded, installed and ran Avast. At restart when it did the scan…it said it found a file with blaster worm. It has options…you know press 1 to delete…it does not let me do ANYTHING but escape. If I press a number I only get question marks. How can I get rid of this thing? I downloaded the removal tool but it did not find it. I only see it on start up. Then, when I escape it does not show that I ever scanned the system. Any ideas? I REALLY need the help! Thanks!!
Hi Ray4kin and welcome,
what do you mean when you say “I only see it on startup” ?
Give more info (OS, blaster name…)
@+
First get to windows update and ensure your Operating System is up to date and patched this is an old vulnerability.
From: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (first described in Microsoft Security Bulletin MS03-026)(users are recommended to patch this vulnerability by applying Microsoft Security Bulletin MS03-039) using TCP port 135. The worm targets only Windows 2000 and Windows XP machines. While Windows NT and Windows 2003 Server machines are vulnerable to the aforementioned exploit (if not properly patched), the worm is not coded to replicate to those systems. This worm attempts to download the msblast.exe file to the %WinDir%\system32 directory and then execute it. W32.Blaster.Worm does not have a mass-mailing functionality.Additional information and an alternate site from which to download the Microsoft patch is available in the Microsoft article, “What You Should Know About the Blaster Worm and Its Variants.”
You should also read this thread General Advice&Tools for virus/trojan/malware removal
Please Help us to Help you - User’s FAQ - we need more information to be able to help fully. A visit to the - thread will give you a lot of useful advice and an idea of the information needed to Help you fully.
Sorry, I am new to this so I hope I am responding correctly.
It shows the virus on a boot scan. It looks like it is in an archived back up…if that makes sense.
However, when I run the full scan after I am all booted up, it does not show a virus anywhere. Does THAT make sense? Is it already locked away somewhere safe?
Thank to all of you trying to help me.
The reason we asked you to visit the User’s FAQ was so you would understand what we need to help you, such as the virus it found (blaster varient??), its location (full path, c:\windows\system, etc.), what operating you are using?
When we ask a question it is to try and pinpoint the problem and without your answers how can we suggest a solution? Otherwise it is not posible to give detailed advice relating to your system.
Did you visit windows update and download the patches?
The boot scan should be able to deal with the virus and a complete scan should confirm this (as you said it can’t be found again). You can also download the Blaster Removal Tool from MS, this is the one for XP but I am guessing your OS.
:-[Thank you DavidR.
I did make sure I had downloaded the patch. I did also download the removal tool. It did not find the Blaster. I am sorry but I could not get it to duplicate the reading again so that I could be more spefic on that. I am running XP.
I will pay more attention to what I need to have in the future. Thank you for your help. Ray4kin
Having run the removal tool and not found it would indicate that the boot time scan did remove it ok.
So obviously if it has been removed you will not get the warning message. Hopefully you are in the clear and will stay that way.
Thank you so very much for your assistance. I always ask a question and then hunt for the solution. I am really aweful about trying to do these things on my own. Again, My many, thanks. I will no longer worry about the bug.