EOL Microsoft Windows Blaster Worm Removal Tool Uninstall

Topic

New Reply

My Secunia PSI (v.3.0) is listing the Microsoft Removal Tool: Blaster/Nachi as “End of Life”. The tool is tied to “windowssystem32blastcln.exe” v.5.1.2600.5512.

I want to uninstall the program but have, long ago, removed the Microsoft spuninst folder for KB833330. I have tried to just delete the exe file but it re-populates within a few seconds.

I know that I can have Secunia just ignore the tool but this doesn’t truly solve the issue. Any suggestions?

Reply | Quote

Replies

Depending on the way blastcln.exe was originally installed, a backup copy can be found in either
C:WINDOWSServicePackFilesi386 or in
C:WINDOWSSystem32dllcache
Both of the above are hidden systems folders so you will have to set Windows Explorer options to display those files.
Once you find YOUR backup copy, delete the backup first – then delete the version in C:WindowsSystem32.
Since now there is no longer a backup, your system will not be able to re-create the pesky thing from backup.

Reply | Quote

There is one more place that blastcln.exe could befound. It is in C:System32Prefetch. If you remove all of the backups (usually 2), and then the main file in C:System32, it will be gone.

Reply | Quote

I’m not sure if it’s OK to pick up this thread again after it seems to have been fixed, but if not please re-direct my post to the appropriate place.

Having the same problem I deleted the blastcln.exe file from:
C:WindowsServicePackFilesi386 as suggested above.

C:WindowsSystem32dllcache (doesn’t exist on my PC, even with hidden files shown).

The thread also said to delete it from C:System32Prefetch but this doesn’t exist on my PC. (WindowsPrefetch does but the file isn’t in there either).

When I then delete the file from C:WindowsSystem32 it regenerates itself within seconds.

Can anyone give me a simple solution, short of ignoring it on the Secunia scan? Thanks.

Reply | Quote

By using everything.exe (from voidtools.com) to display all copies of blastcln.exe,
they can be simultaneously selected and “shift/deleted”. Windows will protest and pop up several dire warnings about system files, so just click through those, and blastcln.exe will be gone at last!

Reply | Quote

Addendum to last: Before using everything.exe or equivalent search utility, be sure that Explorer folder preferences are set to display all hidden system files.

Reply | Quote

I searched the Windows folder for blastcln.exe finding four. Then I used Unlocker to rename each to blastcln.exe.end of life. Windows file checker made a protest which I dismissed. Now Secunia doesn’t report it anymore. If something goes haywire I can undo the rename I guess.

Reply | Quote

Before using everything.exe or equivalent search utility, be sure that Explorer folder preferences are set to display all hidden system files

One of the beauties of Everything searchis that it will find hidden and protected Operating system files independent of the current folder preferences settings. If the file is on your PC, Everything search will find it.

Jerry

Reply | Quote

I’m sorry I wasn’t clear but I didn’t use Everything search I used Windows Search Companion with Folder Options/View set to show everything. Anyhow, blastcln doesn’t appear in Secunia now.

Reply | Quote