How To Remove W32.blaster Vurus

[asmir3912]

Hi my name is asmir...I am good with deliting virus but this one was the hardest one.... for w32. worm blaster u have to find pacth for it... follow these steps as i give u if u have w32.blaster virus.....

Manual Removal
As an alternative to using the removal tool, you can manually remove this threat. The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.


1. Restore Internet connectivity.
2. End the worm process.
3. Obtain the latest virus definitions.
4. Scan for and delete the infected files.
5. Reverse the changes made to the registry.
6. Obtain the Microsoft HotFix to correct the DCOM RPC vulnerability.

Click Start > Run. The Run dialog box appears. Type:

SERVICES.MSC /S
in the open line, and then click OK. The Services window opens.
In the right pane, locate the Remote Procedure Call (RPC) service.

CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

Right-click the Remote Procedure Call (RPC) service, and then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply, and then OK.

CAUTION: Make sure that you change these settings back once you have removed the worm.

2. Ending the Worm process
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for Msblast.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.

THE END....

I HAVE THIS WILL WORD.... TXZ....

[homenet]

I think its a bit late for these instructions. Anyone thats still vunurable to that worm is a lost cause!

[asmir3912]

i know but there is still some people that have that virus.....

two of my friends and cousin had that virus till i didnt delete it......

[MemorY]

You didn't write that above. At least you can post the source where you got that info from like maybe from http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html or somwehre else.

You know how i know this?

Hi my name is asmir...I am good with deliting virus but this one was the hardest one.... for w32. worm blaster u have to find pacth for it... follow these steps as i give u if u have w32.blaster virus.....

many spelling errors because you wrote it and i believe English is not your native language. The rest of the post is without spelling errors.

[SexyBadGirl]

Originally posted here (http://www.AntiOnline.com/showthread.php?threadid=253504#post710965) by MemorY
You didn't write that above. At least you can post the source where you got that info from like maybe from http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html or somwehre else.

You know how i know this?

many spelling errors because you wrote it and i believe English is not your native language. The rest of the post is without spelling errors.


You mean it wasn't the sentence that said "The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines." :p

LoL good call anyway, can you say: BUSTED!

[asmir3912]

AT LEAST I HELP PEOPLE TO DELETE THEM.....

[MemorY]

You mean it wasn't the sentence that said "The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines."

LoL good call anyway, can you say: BUSTED!

damn it lol, i didnt read that part. My bad asmir :D

[asmir3912]

MEMORY...
U KNOW WHAT DUDE....
U SHOULD SHUT THE **** UP...
I AM JUST TRYING TO HELP PEOPLE WHO NEEDS IT...

[MemorY]

MEMORY...
U KNOW WHAT DUDE....
U SHOULD SHUT THE **** UP...
I AM JUST TRYING TO HELP PEOPLE WHO NEEDS IT...


What the **** man. I said i was sorry for not readin' your whole post, what is your problem.

[Agent_Steal]

What I think that Memory is trying to get across Asmir is that maybe next time you should also provide the link where you obtained the info from. That way you can avoid been accidentally accused of having just copied and pasted info.

But overall I can tell that you were just trying to help some people out there who just might still be infected with this virus.

It was a human reading error so just let the past be in the past.

Just my thoughts ......

[Computernerd22]

Can we say plagiarism at it's finest! Just in case if you dont know what that means I will inform you:

a piece of writing that has been copied from someone else and is presented as being your own work 2: the act of plagiarizing; taking someone's words or ideas as if they were your own

We all appreciate you going out of your way to help people with that issue but when you start posting stuff like this

U KNOW WHAT DUDE....
U SHOULD SHUT THE **** UP...
I AM JUST TRYING TO HELP PEOPLE WHO NEEDS IT...

Not cool espically at www.antionline.com this isnt some half ass board this is One of the Best on the Net today remember that asmir3912.

[Richy]

HI asmir
AO forum is for the people who share their knowledge, So that some one, who is in need of help will be benefited. Not fighting or Abusing. It doesn't cost to be nice here.

[Digital Xeron]

First, forget about all those instructions and install the patch from microsoft, it works.
Second, asmir3912, stop typing in caps, it's annoying

[Cybr1d]

AT LEAST I'M TRYIN TO HELP PEOPLE

and we are here doing what......?

enjoy getting banned. If you were in school, you'd be kicked out and maybe sued.

[manicchester]

Maybe some people don't realize how bad plagiarism is and the punishments involved with it....If I copied work that wasn't mine and didn't source it, I would probably be kicked out of PSU. What a thread this has turned out to be.

On a positive note, you tried to help others out which was a good thing...just be sure to read those FAQ's...

[Und3ertak3r]

Certainly Lifted from the symantec website Manual Removal
As an alternative to using the removal tool, you can manually remove this threat. The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.


Restore Internet connectivity.
End the worm process.
Obtain the latest virus definitions.
Scan for and delete the infected files.
Reverse the changes made to the registry.
Obtain the Microsoft HotFix to correct the DCOM RPC vulnerability

Lifted from here http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html..

asmir3912, Mate you would not be bagged (flamed) had you said "Sorry, I made a mistake" instad you came back and attacked those who pointed out your error..

Moste people who come here are capable of following links, and the full artical on symantec is certainly more usefull..

ALSO.. Had you botherd to search these forums you will have seen a massive thread on the matter of the RPC DCOM problem.. AND IF YOU WANTED TO HELP PEOPLE **YOU** would have also posted a link to this..like This Thread (http://www.antionline.com/showthread.php?s=&threadid=247294) or This (http://www.antionline.com/showthread.php?s=&threadid=248280) Oh and Here (http://www.antionline.com/showthread.php?s=&threadid=250319)

Someone did try to give you the benifit of the doubt by assuming that english is not your first language.. Sorry but you know english well enough to use the sentence "Shut the **** Up".. .. English is your first language.. But your "technically Illiterate", or functionaly incapable of forming a meaningful sentance or deciphering the meaning out of any half capably written sentance....


Cheer

[Cybr1d]

I'm wondering how this thread hasn't commited suicide yet :D.

[gore]

Asmir....LOL....ASS SMEAR

HAHAHAHAHAHAHAHAHAHAHAHAHHAHAH

Funny name, ass hole attitude, I like it!

[Und3ertak3r]

I'm wondering how this thread hasn't commited suicide yet

Because we had to wait for Gore to post.. that was worth waiting for..

cheers

[slick8790]

It also might be because memorY and computernerds posts are both flashing positive. :D :D


slick