RE: Purging Blaster.worm

[Rory <nazgul () csn ul ie>]

Should you not apply the patch first and then go about the task of
removing the worm. The point being that the time between you removing the
worm and you patching means that the host can get infected again. There
are automatic removal tools aswell as you may have missed a step in the
removal process.

removel tool:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


cheers,
Rory

On Wed, 13 Aug 2003, Preston, Tony wrote:

>  I manually got rid of it on my work PC with the following steps:
>
> 1) kill msblast.exe process
> 2) delete msblast.exe from windows/system32
> 3) delete msblast.exe*.pf from windows/prefetch
> 4) delete all registry keys with msblast in them
> 5) The patch from Microsoft was applied, but the next
> day I was re-infected after doing steps 1, 2, and 4.
> I repeated these steps today after adding #3 and it is
> not back (althought my firewall blocks port 135 hits
> trying to re-infect).
>
> -----Original Message-----
> From: Jose Guevarra
> To: security-basics () securityfocus com
> Sent: 8/12/2003 8:06 PM
> Subject: Purging Blaster.worm
>
> Hi,
>
>  Has anyone successfully purged the MSBlaster worm. There is a tool out
> there that can do it but is it reliable?
>
> thanx,
>
> ============
>
>
> ------------------------------------------------------------------------
> ---
> ------------------------------------------------------------------------
> ----
>
> ---------------------------------------------------------------------------
> ----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------