Overview

W32.Blaster.Worm Removal Tool is a program from security firm Symantec to remove the W.32 Blaster Worm and its variants.

The Blaster virus came about after a Chinese group looked at a Microsoft patch and reverse engineered it. This led to the ability to create the worm which would be able to spread by spamming from IP addresses without the need for the user to receive an infected email and open the attachment to initiate the worm.

The Blaster approach was intended to initiate a denial of service attack aimed at the windows update site from Microsoft, but due to the company already redirecting users to windowsupdate.microsoft.com, it was possible thwarts the attack pretty easily.

The DCOM RPC service that was problematic with 12 separate vulnerabilities documented opened the door for the development of Blaster. It was patched by Microsoft in MS03-026 and also MS03-039 which restricted access to affected communications ports to only certain Windows services. This left systems infected needing to have the infections removed, which is where this tool from Symantec comes in.

Once the system becomes infected, it usually causes an immediate system reboot where upon the worm fully loads in. The tool itself will get to work terminating the process associated with the worm, then delete the worm files so they cannot load in again, and also deletes the registry values which help the worm run each time Windows is loaded up. This then eradicates the W32.Blaster worm.

Installation

The installation completed without any issues.

There was no adware, toolbars, malware or spyware included with the setup package.

W32.Blaster.Worm Removal Tool requires Windows 2000 or Windows XP

Interface

The interface takes the user through the process of removing the active Blaster worm and ensuring that it will not be present to load into memory the next time Windows is loaded up.

There are also some detailed instructions available from Symantec with recommendation for removal and best practices thereafter.

Pros

• Locates and removes the W32.Blaster Worm infection
• Prevents the worm re-installing itself post-removal after rebooting the PC
• Useful to remove in conjunction with updating affected Windows systems to prevent possible re-infection

Cons

• None.

Alternatives

Sophos also released a Blaster removal tool of their own.

Conclusion

W32.Blaster.Worm Removal Tool is an essential tool for removing the annoyance of the W32.Blaster worm infection so a system is no longer being affected.