Home > Technical Support > Blaster Worm

Protecting against and cleaning up the Blaster worm

If your computer is running one of the following, you may be vulerable to an Internet worm referred to as Blaster:

Quick Links:

Overview:
Blaster is a worm that exploits the RPC vulnerability using TCP port 135. This vulnerability was made public by Microsoft in July with patches made immediately available. The worm attempts to replicate itself to other computers on your local area network and on the Internet at large.

Full technical details about the worm can be found here from Symantec.

To clean your system, please follow these steps:

1. Follow the instructions by Microsoft in their security bulletin titled " What You Should Know About the Blaster Worm and Its Variants". This bulletin describes the problem, its symptoms, and what you need to do to protect your computer.
2. Make sure to remove the worm using a removal tool, such as this tool from Symantec.

Tip:
If your computer is running Windows XP, it might try to reboot. When you receive the reboot warning, quickly follow these steps to keep your computer from rebooting. This may have to be done a few times while downloading the patch and fix tool.

• Click Start then Run
• Type in: shutdown /a
• Click OK

Symptoms:
If your computer is running Windows XP and are infected, you are likely to encounter this error:

If your computer is running Windows 2000 and are infected, you are likely to encounter this error: