How to Remove Win 32 Blast.Worm

What is win 32 Blast.Worm

win 32 Vlast.Worm is a worm that exploit windows vulnerability and attack users’ computers. Tee Support experts had studied it and found that this worm has other variants, like  W32.Blaster.A.Worm,W32.Blaster.B.Worm,W32.Blaster.C.Worm,W32.Blaster.D.Worm, W32.Blaster.E.Worm. If a infected computer runs on windows XP, this computer will keep restarting every few minutes as it as it cause the remote RPC service to terminate displaying a message "Windows must now restart because the Remote Procedure Call (RPC) Terminated Unexpectedly".

But it will cause more serious problem to your computer even though you download new-released patch to keep it away from you.  As a worm, it sneaks into your computer and will open the backdoor—the port—to provide more convenience with crackers. This is a deadly shot when some
ports in your computer are known to hackers and they can easily attack your computer trough those ports.  win32 worm blaster can also retrieve your files—both system files and private files stored on harddrive. After they successfully get your files, they will analyze and have a main idea of your system configuration and then work out a plan to attack your computer. As to your private information, they might use it for evil purpose. We have dealt some clients and found they files are encrypted by CyptoLocker—which is incurred by win32 worm blaster.

How did it spread

It can be spread in many ways. By bundling with other files or programs, especially bundling with those patches or updates, win32 worm blaster get on your computer in a way that antivirus could not find it. Second, be aware when you open a link or attachment, you will be more likely to get infected by win32 worm blaster if you open them casually. Third is that viewing the insecure sites will also risk being caught by win32 worm blaster as they are every in the site. They can pop up as a commericial ad and you will trigger win32 worm blaster if you click those pop-ups.

How to remove them

Step 1: Enter the Safe Mode with Networking
Keep tapping F8 when you restart your computer and then choose Safe Mode with Networking.

Step 2:  Enter the Task Manager and then end related process.
press  "Ctr+Alt+Del" or "Ctrl + Alt + Esc" to enter the Task Manager.

Step 3: Go to the registry and delete corrupted registry values.
Hit “Win + R” and then type “regedit” to enter the registry editor.

Find following registry values and delete them all:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "windows auto update"="msblast.exe"

Find the following files and delete them all:
•    C:\Windows\System32\msblast.exe
•    C:\Windows\System32\penis32.exe
•    C:\Windows\System32\teekids.exe
•    C:\Windows\System32\mspatch.exe
•    C:\Windows\System32\mslaugh.exe
•    C:\Windows\System32\enbiei.exe

Step 4: Restart the computer to make your change effective.

If you have any problem when removing the virus, please click here to get professional help and we will work out solution to bring your computer back to normal.