W32/Blaster-G

Please follow the instructions for removing worms.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the worm.

Windows NT/2000/XP

In Windows NT/2000/XP you will also need to edit the following registry entries. The removal of these entries is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Helper = <SYSTEM>\eschlp.exe /fstart
MSUpdate = <SYSTEM>\svchosthlp.exe
SPUpdate = <SYSTEM>\svchosthlp.exe

and delete them if they exist.

Close the registry editor.

W32/Blaster-G is a worm that uses the internet to exploit the DCOM vulnerability in the RPC (Remote Procedure Call) service as described in W32/Blaster-A.

W32/Blaster-G copies itself to the Windows system folder as eschlp.exe. The worm also creates a backdoor Trojan component in the Windows system folder using the name svchosthlp.exe. The following registry entries are created to ensure both components are run at system logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Helper = <SYSTEM>\eschlp.exe /fstart
MSUpdate = <SYSTEM>\svchosthlp.exe
SPUpdate = <SYSTEM>\svchosthlp.exe

The following registry entry is modified to change the default Microsoft Internet Explorer start page to point to the following:

HKCU\Software\Microsoft\Internet Explorer\Main\
Start Page = http://www.getgood.biz