Solved Got a win32 blaster worm and can't get rid of it?

[pitt78]

Microsoft essentials didn't detect it, maleware bytes didn't detect it. I can't open any programs, the option to open or install as administrator is NOT THERE. I used ESET online scanner it detected the two worms and "said" it cleaned them. And I just found out win 7 deletes all my restore points.

I tried to install the trial version of ESET and got a message that "the local administrator has set polices to prevent the installation"!

I've tried the fxbeagle exe, the fixblast exe, and the w32 blaster worm removal tool...all to no avail!

Please guys, I need serious help?

 

[parabellum]

Download the portable version of SuperAntiSpyware which comes as a .com file and run it:

http://www.superantispyware.com/portablescanner.html

 

[pitt78]

Ok, gonna try in safe mode.

 

[ZORG]

Greetings,

By the way, what kind of win32 blaster you got there? Knowing the full description may help you find a fixed tools for removing it, for example at http://us.norton.com/security_response/threatexplorer/azlisting.jsp?azid=W. If you´re not able to find a fixed tool, try to scan using spybot and search. I used to scan using HIJACK THIS too, but i´m new to Win 7 and i´m not sure if it´s fully compatible.

zorg

 

[parabellum]

Greetings,

By the way, what kind of win32 blaster you got there? Knowing the full description may help you find a fixed tools for removing it, for example at Virus, Spyware and Adware, Dialers, Hack tools, Hoaxes | Threat Explorer. If you´re not able to find a fixed tool, try to scan using spybot and search. I used to scan using HIJACK THIS too, but i´m new to Win 7 and i´m not sure if it´s fully compatible.

zorg

HijackThis is compatible but other bits of malware needs to die first before the OP runs it.

 

[pitt78]

Ok, tried it and it didn't work Not sure what kind of worm blaster it is?

 

[parabellum]

Ok, tried it and it didn't work

Did it run?

 

[pitt78]

Sorry should have explained better. It ran, scanned found threats and removed them....but nothing has changed. Still can't open or install programs( get the "this is not a valid win32 application" ) and to run or install as admin is still not there.

 

[parabellum]

This should fix the .exe's:

File Association Fixes for Windows 7 - The Winhelponline Blog

If it does run Malwarebytes again.

 

[ZORG]

Well,

Seeing that we´ve not been able to identify what blaster you got and knowing that your AV doesn´t seem to have worked right. Let´s try to do it the other way. I used lately a sophos rootkit, compatible with win 7. It helps you find some hidden trojans.

zorg

 

[pitt78]

Parabellum, it will not allow me to "merge" in normal or safe mode. It gives me a warning "Cannot import C:\USERS\bmann\desktop\exe_fix_win7.reg. Not all data was successfully written to the registry. Some keys are open by the systems other processes". That was in safe mode.

Is there a way I can determine what kind or win32 worm I have?

 

[parabellum]

Try here:

When you run an .exe file on a Windows Vista-based or Windows 7-based computer, the file may start a different program

And here:

http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html

 

[Hopalong X]

Download details: Microsoft® Windows® Malicious Software Removal Tool (KB890830) x64

MS removal tool. Try the above if it will download and run.


If not try here
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, or Windows XP

Scroll down the page to this. Gives instructions to download and run.
How to download and run the Microsoft Malicious Software Removal Tool

Also just underneath it is two auotofix options. Might repair and allow download and running.

Mike

 

[pitt78]

Neither way worked work hopalong

 

[Hopalong X]

Let me find a pro.

 

[parabellum]

Neither way worked work hopalong

You try the .exe fix?

 

[pitt78]

Yes parabellum.

 

[parabellum]

I'd get all data off the drive with an Ubuntu live CD and a USB then reformat 7.

 

[Hopalong X]

A clean install would work but any removed data is ruined that you save unless you get rid of the worm.

Unless your in a big hurry wait for some help.

My 2 cents.

Mike

 

[gregrocker]

Copy out your data now to an external, flash stick or DVD which you then quarantine until it is scanned beyond doubt, realizing there is a risk to any machine which runs the scans.

You can use the Win7 DVD or Repair CD to copy out your files: http://www.sevenforums.com/tutorials/93347-copy-paste-windows-recovery-console.html or Paragon Rescue CD: Rescue Kit Free Edition | PARAGON Software Group - free partition software, hard disk partitioning

See if you can remove the infection by running a bootable CD scan: FREE Bootable AntiVirus Rescue CDs Download List

If not, wipe the HD and clean reinstall: http://www.sevenforums.com/tutorials/91339-ssd-hdd-optimize-windows-reinstallation.html
http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html
http://www.sevenforums.com/tutorials/31402-clean-install-upgrade-windows-7-version.html

For Factory OEM: If you don't have a Win7 DVD, run Recovery Disks if you made them or as a last resort run the bootable Recovery partition which itself may be infected. This does not wipe the HD of infection however so you may need to order DIsks if you didn't make them, or find a DVD to clean reinstall factory OEM using these suggested steps: http://www.sevenforums.com/installation-setup/125874-re-install-windows-7-a.html#post1086729