How to Remove W32.Blaster.Worm (Uninstall Guide)

W32.Blaster.Worm is one of the most wide spread worms ever that was first noticed in August, 2003. It spreads by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205). This vulnerability was fixed, a patch is available here: Microsoft Security Bulletin MS03-026. This computer worm targets machines running Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003. Apple, Unix and other platforms can not be infected. When executed, the Blaster worm attempts to retrieve a copy of the file msblast.exe, penis32.exe, teekids.exe, mspatch.exe, mslaugh.exe or enbiei.exe from the host that compromised the computer. Downloaded file is saved in the Windows system folder. The infected computer then scans the internet and local networks looking for vulnerable computers.

Other variants of Blaster Worm:

• W32.Blaster.A.Worm
• W32.Blaster.B.Worm
• W32.Blaster.C.Worm
• W32.Blaster.D.Worm
• W32.Blaster.E.Worm
• W32.Blaster.F.Worm

On Windows XP W32.Blaster.Worm can cause the remote RPC service to terminate displaying a message "Windows must now restart because the Remote Procedure Call (RPC) Terminated Unexpectedly". The infected computer might restart every few minutes.



In order to remove Blaster worm from the infected computer you need to install Microsoft patch and then run W32.Blaster.Worm removal tool or remove the worm manually. Accidental computer shut downs prevents the required patch and removal tools from being downloaded and installed. Thankfully, there is an easy way to stop this. Please follow W32.Blaster.Worm removal instructions below.

Important! If you've got the following notification, your computer is infected with a rogue antivirus program and not the original W32.Blaster.Worm.



To remove the rogue antivirus program from your computer, please follow this removal guide.
However, if you believe that your computer is infected with the W32.Blaster.Worm, please follow the removal instructions below.

Download recommended anti-malware software and run a full system scan. It will detect and remove this infection from your computer.

---

W32.Blaster.Worm removal instructions:

1. Select Start -> Run (or press WinKey+R)
2. Type in: shutdown -a
3. Click OK or press Enter.



4. Download and install Microsoft patch MS03-039.
5. Then run W32.Blaster.Worm Removal Tool. You can choose one of these:

• Sophos Blaster Removal Tool
• Symantec W32.Blaster.Worm Removal Tool
• McAfee Blaster Worm Removal Tool

6. Restart the computer and re-connect to the internet. You should run Blaster Worm Removal Tool again to ensure that your computer is clean.

7. Download recommended anti-malware software (direct download) and run a full system scan to remove this worm from your computer.

The worm can download additional malware onto your computer. We have to make sure that your computer is not infected with other malicious software, specifically trojan downloaders.

---

W32.Blaster.Worm manual removal instructions:

1. Download and install Microsoft patch MS03-039.
2. Press Ctrl+Alt+Delete or Ctrl+Shift+Escape. You should now see the Windows Task Manager or a screen where you can select the Task Manager to be run.
3. Click on the Processes tab.
4. Look for a process(es) named msblast.exe, penis32.exe, teekids.exe, mspatch.exe, mslaugh.exe, enbiei.exe in the list
5. Click the process(es) to highlight it and then click the End Process button. Close Task Manager.
6. Open Windows Registry Editor (click Start -> Run. Type Regedit and click OK or press Enter).
7. Locate the HKLM\Software\Microsoft\Windows\CurrentVersion\Run entry.
8. In the right hand pane select windows auto update = msblast.exe and delete it.
9. Restart the computer and re-connect to the internet.

10. Download recommended anti-malware software (direct download) and run a full system scan to remove this worm from your computer.

The worm can download additional malware onto your computer. We have to make sure that your computer is not infected with other malicious software, specifically trojan downloaders.

---

W32.Blaster.Worm files and registry values:

Files:

• C:\Windows\System32\msblast.exe
• C:\Windows\System32\penis32.exe
• C:\Windows\System32\teekids.exe
• C:\Windows\System32\mspatch.exe
• C:\Windows\System32\mslaugh.exe
• C:\Windows\System32\enbiei.exe

Registry values:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "windows auto update"="msblast.exe"

Share this information with other people: