UPDATE: November 2003
Blaster and Welch Worm

Before you continue with the steps below, please download the Microsoft Security Patch for your operating system. (XP or 2000) This patch is specific to the blaster and welch worms and is not a full update.

I. Steps to protect yourself from the Blaster Worm

1. Download the FixBlast.exe file from:

securityresponse.symantec.com/avcenter/FixBlast.exe

2. Save the file to a convenient location, such as your downloads folder or the Windows Desktop (or removable media that is known to be uninfected, if possible).

3. Close all the running programs before running the tool.

4. If you are running Windows XP, then disable System Restore. To do this click start, then find my computer. Right click on this icon then select the properties option. The system restore tab will be visible in the window that comes up. Click on the system restore tab and check the box that says disable system restore. If you have the "my computer" on your desktop please right click that and proceed as instructed.

CAUTION: If you are running Windows XP, we strongly recommend that you do not skip this step. The removal procedure may be unsuccessful if Windows XP System Restore is not disabled, because Windows prevents outside programs from modifying System Restore.

5. Double-click the FixBlast.exe file to start the removal tool.

6. Click "Start" in the window that comes up to begin the process and allow the tool to run.

7. Restart the computer.

8. Run the removal tool again to ensure that the system is clean.

9. If you are running Windows XP, then re-enable System Restore.

II. Steps to protect yourself from the Welch Worm

1. Download the FixWelch.exe file from:

www.symantec.com/avcenter/FixWelch.exe

2. Save the file to a convenient location, such as your downloads folder or the Windows desktop (or removable media known to be uninfected).

3. Close all running programs before running the tool.

4. If you are on a network or you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.

5. If you are running Windows ME or XP, then disable System Restore. To do this click start, then find my computer. Right click on this icon then select the properties option. The system restore tab will be visible in the window that comes up. Click on the system restore tab and check the box that says disable system restore. If you have the "my computer" on your desktop please right click that and proceed as instructed.

WARNING: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.

6. Double-click the FixWelch.exe file to start the removal tool.

7. Click Start to begin the process, and then allow the tool to run.

8. Restart the computer.

9. Run the removal tool again to ensure that the system is clean.

10. If you are running Windows Me/XP, then re-enable System Restore



Related Student Computer Information:

Search and Destroy Spybot installation instructions