News

Microsoft Provides Blaster Removal Tool

• By Scott Bekker
• 01/07/2004

Blaster emerged in August to exploit a gaping security hole in Windows that Microsoft provided a patch (MS03-026) for the previous month. The worm crashed vulnerable computers, slowed local subnets and generated a tremendous amount of scanning traffic on target ports around the Internet. A later discovery that the underlying vulnerability was wider than Microsoft originally thought prompted a second patch (MS03-039).

"Even though many users have applied the MS03-026 or MS03-039 security patches for Windows, research shows there is a home user population that have not taken the step to disinfect the virus and thus may still be infected by the Blaster worm," a Microsoft spokesperson said.

Internet backbone providers have told Microsoft that traffic levels on their networks are still high in the wake of the worm. According to Microsoft, infected home systems are still actively transmitting the worm and contributing to Internet congestion. The company says that many affected users would have no warning of the infection other than a slight performance problem.

The new tool, the Windows Blaster Worm Removal Tool, is designed to help customers remove common forms of the Blaster worm from infected PCs. The tool runs on systems that have MS03-026 or MS03-039 installed. It is available for download at: www.microsoft.com/downloads.

Development of worm and virus removal tools is an area that Microsoft has traditionally left to anti-virus vendors, many of whom created Blaster removal tools months ago. Those tools are often available for free download and can be used independently of licensed copies of the anti-virus software. Releasing a Blaster removal tool is one of the first steps Microsoft has taken into anti-virus companies' territory since acquiring anti-virus talent of its own with the June purchase of the intellectual property and technical assets of GeCAD Software Srl, an 11-year-old Romanian anti-virus firm.