Contact Us Search Site Index About This Site Edit Decrease text size Increase text size Georgetown University main web site Contact Us Search Site Index About This Site
spacer spacer spacer
University Information Services at Georgetown University
Faculty Help Staff Help Student Help About UIS

How to Remove W32.Blaster and W32.Welchia

These instructions will show you how to remove both the Blaster worm and the Welchia worm from your computer and prevent these worms from infecting your computer again. If you are not sure which of the two worms has infected your computer, run both the Blaster and the Welchia removal tools.

 

STEP 1: Shut Down and Disconnect Your Network/Internet Connection!

 

Unless you unplug the cable that connects your computer to your network jack, your computer will get infected and spread the worm to others.

 

STEP 2: Applying the Microsoft Security Patch (KB 823980)

You must install this patch to prevent your computer from getting compromised again. However, the patch will not clean any existing infection from your computer.

  1. Get a UIS Blaster Removal CD / the UIS Welchia Removal CD from the UIS Service Desk in St. Mary's Hall. If that is not possible, use an uninfected computer to download the appropriate version of the patch (Windows XP or Windows 2000) from the UIS Software Database to a CD.
  1. If using a UIS CD: Double-click on the Step 2 - Windows Patch Files folder.

    If using a CD you created:  Use Microsoft Explorer to view the file on your CD. If you have Windows 2000, your patch will be called Windows2000-KB823980-x86-ENU.exe. If you have Windows XP, your patch will be called WindowsXP-KB823980-x86-ENU.exe.  Double-click the patch to begin installation.
  1. When the patch has finished running, reboot your computer.
 
 

STEP 3:  Removing the Infected Files

  1. Run the W32.Blaster Removal Tool or the W32.Welchia Removal Tool from the UIS CD. If you do not have a UIS CD, use an uninfected computer to download the tools from the UIS Software Database to a CD.
 

Note: If you are using Windows XP, you must follow #2-6 below; if you are using Windows 2000, skip to #7.

 
  1. Click on the Start button on your task bar, then click on My Computer.
 worm removal image
  1. Click on the View system information link (it's on the left-hand side of the window).

  1. Click on the System Restore tab.

 

  1. Then click on Turn off System Restore. (A checkmark should appear beside it.)

 

  1. Close the System Properties window.
  1. Close all other programs, then double-click on the FixBlast.exe file that you downloaded from the Software Database.
  1. When prompted, click on the Start button and allow the tool to run.

Note: If, when running the tool, you see a message that the tool was not able to remove one or more files, run the tool in Safe Mode. Shut down your computer, turn off the power, and wait 30 seconds. Restart the computer while holding down the F8 key on your keyboard. When prompted, use the arrows keys on your keyboard to highlight Safe Mode, then press the Enter key on your keyboard. When the computer has finished booting up in Safe Mode, run the virus removal tool again.

  1. After the tool has finished running, restart your computer.
  1. Run the tool a second time to make sure nothing has been missed.
  1. Turn your System Restore setting back on.
  1. If you are unable to fully remove the virus with the automated removal tool, please contact the Help Desk. DO NOT REATTACH YOUR COMPUTER TO THE NETWORK JACK.
  1. Make sure your virus definitions are up to date.
spacer