Restoring Internet connectivity and preventing the
computer from shutting down
In many cases, on both Windows 2000 and XP, changing the
settings for the Remote Call Procedure (RPC) service may
allow you to connect to the Internet to obtain downloads,
and will stop the computer from shutting down.
Click Start > Run. (The Run dialog box appears.)
Type:
SERVICES.MSC /S
in the open line, and then click OK. (The Services window
opens.)
In the right pane, locate the Remote Procedure Call (RPC)
service.
----------------------------------------------------------
----------------------
CAUTION: A service named Remote Procedure Call (RPC)
Locator exists. Do not confuse the two.
----------------------------------------------------------
----------------------
Right-click the Remote Procedure Call (RPC) service, and
then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second
failure, and Subsequent failures to "Restart the
Service."
Click Apply, and then click OK.
----------------------------------------------------------
----------------------
CAUTION: Make sure that you change these settings back
once you have removed the worm.
----------------------------------------------------------
----------------------
Obtaining and running the tool
----------------------------------------------------------
----------------------
Note: You need administrative rights to run this tool on
Windows 2000 or Windows XP.
----------------------------------------------------------
----------------------
Download the FixBlast.exe file from:
http://securityresponse.symantec.com/avcenter/FixBlast.exe
Save the file to a convenient location, such as your
downloads folder or the Windows Desktop (or removable
media that is known to be uninfected, if possible).
To check the authenticity of the digital signature, refer
to the section, "Digital signature."
Close all the running programs before running the tool.
If you are running Windows XP, then disable System
Restore. Refer to the section, "System Restore option in
Windows Me/XP," for additional details.
----------------------------------------------------------
----------------------
CAUTION: If you are running Windows XP, we strongly
recommend that you do not skip this step. The removal
procedure may be unsuccessful if Windows XP System
Restore is not disabled, because Windows prevents outside
programs from modifying System Restore.
----------------------------------------------------------
----------------------
Double-click the FixBlast.exe file to start the removal
tool.
Click Start to begin the process, and then allow the tool
to run.
----------------------------------------------------------
----------------------
Note: If, when running the tool, you see a message that
the tool was not able to remove one or more files, run
the tool in Safe mode. Shut down the computer, turn off
the power, and wait 30 seconds. Restart the computer in
Safe mode and then run the tool again. All the Windows 32-
bit operating systems, except Windows NT, can be
restarted in Safe mode. For instructions, read the
document "How to start the computer in Safe Mode."
----------------------------------------------------------
----------------------
Restart the computer.
Run the removal tool again to ensure that the system is
clean.
If you are running Windows XP, then re-enable System
Restore.
Run LiveUpdate to make sure that you are using the most
current virus definitions.
When the tool has finished running, you will see a
message indicating whether W32.Blaster.Worm infected the
computer. In the case of a worm removal, the program
displays the following results:
Total number of the scanned files
Number of deleted files
Number of terminated viral processes
Number of fixed registry entries
