Windows 7: W32 Blaster Worm

Hello,

My computer has caught this worm and is driving me crazy, it starts with the spyware protection software which tells me I have many viruses. Im aware its a scam but i cant seem to resolve the problem in safe mode using spybot & uniblue registry cleaner.

Please could someone help me,
Thank you

First off, what is the name of this fake spyware protection software? There are various programs that target specific fake AV/Spyware programs available, in most instances.

Is there any chance you can roll back 2 or 3 points past the infection point?

Try d/l and running this:

Blaster Removal tool

W32.Blaster.Worm Removal Tool | Symantec

That's a start but depending on what you have, it'll probably require more in depth cleaning then that.

Other tools to consider running: MS Malicious software removal tool

http://www.microsoft.com/downloads/e...ang=en&pf=true

Norton Power Eraser

http://security.symantec.com/nbrt/npe.asp?lcid=1033

Malwarebytes

Malwarebytes

All these tools are free and if you cannot run them in regular mode, try running them in safe mode. You should do full system scans while disconnected from the internet as most malware tends to "call home for help" if it's trying to be deleted

I've downloaded blaster removal tool and ran it in safe mode but it couldnt find it, im using malwarebytes now and waiting for scan to end but I dont think it'll work.

The software comes up as defender spyware protection i think

Malwarebytes' may be able to find and delete part of it. Post the .txt log when it's finished scanning.

Its found two problems which are

Rogue.Installer & Trojen.FakeAlert.Gen.

The saved log .txt is:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6287
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385
06/04/2011 18:08:11
mbam-log-2011-04-06 (18-07-54).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 316000
Time elapsed: 21 minute(s), 44 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spyware Protection (Trojan.FakeAlert.Gen) -> Value: Spyware Protection -> No action taken.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\LizzieO\AppData\LocalLow\Sun\Java\deployment\cache\6.0\32\7e5bde20-6c66ec05 (Rogue.Installer) -> No action taken.

Im goin to remove the problems now and see if that works

Well it seems like that worked, alittle slower than I remember but that might just be me.

Thanks alot for your help :)

Glad you got it sorted.

Your next step is to do a full system scan with an AV and with Malwarebytes just to be sure there are no traces left.

Many people in the forum run MSE.

Virus, Spyware & Malware Protection | Microsoft Security Essentials

Also, remember to update the malwarebytes definitions regularly (they release new ones daily) and scan on a regular basis.

Did you go back into Malwarebytes' and
* Be sure that everything is checked, and click Remove Selected?

Yes Jacee i scanned my computer 3 times after the removal and it seems to have cleared everything up!

Malwarebytes.org is the best site i have ever used. Thank you again this thread can be closed :)

I had something like that, ended up giving it to my brother to sort out, and got myself a new laptop. After 6 months he has finally got around to sorting it out (he also fixes Amegias), so I am hoping to get that one back soon :).

Hope your rid of this evil worm!