Obtaining and running the tool

--------------------------------------------------------------------------------
Notes: 
You need administrative rights to run this tool on Windows 2000 or Windows XP. 
If you are running MS Exchange 2000 Server, you may want to exclude the M drive from the scan by running the tool from a command line with the Exclude switch. Regardless of whether you do this, before running the tool, back up all the data on the M drive. For information on why this is necessary, read the Microsoft Knowledge Base article at: http://support.microsoft.com/default.aspx?scid=kb;en-us;299046.

--------------------------------------------------------------------------------

Download the FixBlast.exe file from:

http://securityresponse.symantec.com/avcenter/FixBlast.exe



Save the file to a convenient location, such as your downloads folder or the Windows Desktop (or removable media that is known to be uninfected, if possible). 
To check the authenticity of the digital signature, refer to the section, "Digital signature." 
Close all the running programs before running the tool. 
If you are running Windows XP, then disable System Restore. Refer to the section, "System Restore option in Windows Me/XP," for additional details.


--------------------------------------------------------------------------------
CAUTION: If you are running Windows XP, we strongly recommend that you do not skip this step. The removal procedure may be unsuccessful if Windows XP System Restore is not disabled, because Windows prevents outside programs from modifying System Restore. 
--------------------------------------------------------------------------------


Double-click the FixBlast.exe file to start the removal tool. 
Click Start to begin the process, and then allow the tool to run.


--------------------------------------------------------------------------------
Note: If, when running the tool, you see a message that the tool was not able to remove one or more files, run the tool in Safe mode. Shut down the computer, turn off the power, and wait 30 seconds. Restart the computer in Safe mode and then run the tool again. All the Windows 32-bit operating systems, except Windows NT, can be restarted in Safe mode. For instructions, read the document "How to start the computer in Safe Mode."
--------------------------------------------------------------------------------


Restart the computer. 
Run the removal tool again to ensure that the system is clean. 
If you are running Windows XP, then re-enable System Restore. 
Run LiveUpdate to make sure that you are using the most current virus definitions.

When the tool has finished running, you will see a message indicating whether W32.Blaster.Worm infected the computer. In the case of a worm removal, the program displays the following results: 
Total number of the scanned files 
Number of deleted files 
Number of terminated viral processes 
Number of fixed registry entries