How to Use W32/BLASTER Remover Tools to Clean Infected Windows PCs

Step-by-Step W32/BLASTER Remover — Protect Your System from Blaster Worm

The W32/Blaster (Blaster) worm exploited an older Windows RPC vulnerability and spread rapidly in 2003. If you suspect an infection or are cleaning legacy systems, follow these steps to detect, remove, and harden machines against Blaster.

Important notes

• Scope: These instructions target Windows systems susceptible to the Blaster worm (legacy Windows XP/2000/NT systems or unpatched equivalents). Modern supported Windows versions are not vulnerable.
• Backup: Before making changes, back up important data if possible.
• Offline recommended: If you suspect active infection, isolate the machine from networks to prevent spread.

1. Identify symptoms

• Frequent system crashes or blue screens with error mentioning rpcss.dll or rpcss service.
• High CPU usage from unknown processes.
• Unexpected reboots with a message referencing “RPC” or “msblast.exe”/“blaster.exe”.
• Presence of suspicious files in C:\Windows\ or C:\Windows\System32\ such as msblast.exe, windows32.exe, or other unfamiliar executables.

2. Isolate the machine

1. Disconnect from wired and wireless networks.
2. If the machine is part of a domain, notify your IT admin and disconnect it from the domain network.

3. Prepare removal tools

• Use a clean, up-to-date antivirus/antimalware rescue media (bootable USB or CD) from a trusted vendor (e.g., Microsoft Safety Scanner, Malwarebytes Rescue, or reputable AV vendors’ rescue disks).
• If working on an offline legacy system, obtain a removal tool specifically detecting Blaster from a reputable vendor or use known AV signatures that include Blaster detection.

4. Boot and scan

1. If possible, boot the infected machine from clean rescue media and run a full scan. Booting from rescue media prevents the worm from running during cleanup.
2. If rescue media isn’t available, boot into Safe Mode (press F8 at boot) and run a full antivirus scan using installed AV software or an on-demand scanner.

5. Manual removal (if automated tools fail)

Only attempt manual removal if you are comfortable editing system settings and the automated scanners didn’t remove the worm.

1. Open Task Manager (Ctrl+Shift+Esc) and terminate suspicious processes such as msblast.exe or processes with unusual names and high CPU usage.
2. Search for and delete known Blaster files:
   • C:\Windows\system32\msblast.exe
   • C:\Windows\system32\mspatcha.exe
   • Other unfamiliar executables in C:\Windows\ or C:\Windows\System32</li>
3. Remove malicious registry entries (use regedit carefully):
   • Check the Run keys:
     • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
     • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • Remove entries that point to the deleted worm files.
4. Remove scheduled tasks or services created by the worm:
   • Services: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services(look for new or unknown service names referencing msblast)
   • Scheduled tasks: Use Task Scheduler to delete suspicious tasks.
5. Clear temporary folders:
   • %TEMP%, C:\Windows\Temp, and other common temp locations.

6. Reboot and re-scan

• Reboot the system normally and run a complete full-disk scan with an updated antivirus to ensure no remnants remain.

7. Patch and update

• Immediately install all critical Windows updates and security patches, especially the patch that fixed the RPC DCOM vulnerability (MS03-026 / KB 823980) or the equivalent for your OS.
• Update installed software and security definitions for antivirus/antimalware.

8. Restore network and monitor

1. Reconnect to the network only after verifying the machine is clean.
2. Monitor network traffic and logs for anomalous activity.
3. If the host was part of a network, scan other machines and servers for infection.

9. Harden and prevent reinfection

• Apply all Windows updates and enable automatic updates where supported.
• Enable a host-based firewall and block unnecessary inbound RPC ports (TCP 135 and dynamic RPC ports).
• Use up-to-date antivirus/antimalware with real-time protection.
• Restrict administrative privileges—operate daily accounts with least privilege.
• Maintain offline backups and periodically test restoration.

10. When to seek professional help

• If you cannot remove the worm, system instability persists, or sensitive systems are affected, engage a professional incident response or IT specialist.
• For compromised domain controllers or business-critical servers, assume possible lateral movement and consider full forensic analysis and rebuild.

Quick checklist

• Disconnect from network
• Boot rescue media and scan
• Remove identified malicious files and registry entries
• Install MS03-026 / KB 823980 (or equivalent)
• Re-scan and monitor
• Harden system and update AV

If you want, I can produce a concise printable checklist or step-by-step commands for a specific Windows version (e.g., Windows XP or Windows 2000).