URGENT: Error: W32Blaster/Worm

[rachymac]

Hi guys,

PLEASE can someone help me? I'm on my mum's computer at the moment because I can't do ANYTHING on my own computer thanks to this blasterworm. It started yesterday with a fake "McAfee" scan running on my computer and claiming to have found spyware (I know it's fake becuase I have Norton rather than McAfee installed) Sure enough, it started telling me I had to pay to download the full version.

I was doing some work on my computer this evening (whilst waiting for a reply on another forum about how to remove it!) when a warning popped up that Microsoft Office could not run due to w32blaster/worm - it closed Microsoft Word and since then has not allowed me to open anything - when I try opening Word / Internet / Norton it immediately closes again and comes up with the same error pop-up. I tried rebooting my computer and starting it in Safe Mode, but there was no option coming up for Safe Mode in start-up and pessing F8 as recommended by soemone else didn't do anything!

It won't run anything, including CD-Roms, so I can't even download stuff from this computer and transfer it over. HELP!

 

[Britton30]

Welcome to Seven Forums rachymac.
Anytime you see a scan starting you did not start, immediately press ALT+F4 repeatedly until ALL windows close, using the red X will allow the scan to run and BAM, you're infected.

From your mum's PC login to your Norton and download the Norton Bootable Recovery Tool, burn it to a CD or a USB flash drive. then boot the infected computer with the NBRT inserted and run a scan. Make sure you download the correct 32 or 64 bit version for your system. You will have to enter your Norton key to use the tool.

here is another option to try too. http://www.sevenforums.com/tutorials/166445-microsoft-standalone-system-sweeper.html#post1424613

 

[Corrine]

You don't have the Blaster Worm. Rather, it is a rogue (fake) called "Spyware Protection".

1. Since you cannot start the computer in Safe Mode with Networking, try downloading the following files to your Mom's computer and transferring them to your machine.

2. Please download rkill from one of the following links and transfer to your Desktop:

One, Two,Three or Four

• Double-click rkill to run.
• A command window will open then disappear upon completion, this is normal.
• Please leave rkill on the Desktop until otherwise advised.
• Do NOT restart your computer after running rkill as the malware program(s) will start again.

Note: If you you receive security warnings about rkill, please ignore and allow the download to continue.

3. Please transfer Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, be sure Quick scan is selected, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, EXCEPT items in System Restore as shown in this sample:
  
  
• Click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See the Note below)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

** Note **

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Did that solve the problem?