Page 1 of 2 12 LastLast
Results 1 to 15 of 16
  1. #1
    New Lounger
    Join Date
    Dec 2009
    Location
    Grand Rapids, Michigan, USA
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts

    EOL Microsoft Windows Blaster Worm Removal Tool Uninstall

    My Secunia PSI (v.3.0) is listing the Microsoft Removal Tool: Blaster/Nachi as "End of Life". The tool is tied to "\windows\system32\blastcln.exe" v.5.1.2600.5512.

    I want to uninstall the program but have, long ago, removed the Microsoft spuninst folder for KB833330. I have tried to just delete the exe file but it re-populates within a few seconds.

    I know that I can have Secunia just ignore the tool but this doesn't truly solve the issue. Any suggestions?

  2. #2
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    I believe that's because it is a component that is not included in XP SP1. Blaster appeared in the late 2003, so that line is probably ignored when the presets are loaded. Then it's added by your SP3 and reappears for removal.

    You might try installing KB833330 again and see if the uninstaller for that update installs.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  3. #3
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    4,752
    Thanks
    171
    Thanked 650 Times in 573 Posts
    Quote Originally Posted by DocWatson View Post
    You might try installing KB833330 again and see if the uninstaller for that update installs.
    From where? Notice This tool is no longer available.

    Bruce

  4. #4
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    Quote Originally Posted by BruceR View Post
    The entire notice reads, "Notice - This tool is no longer available. It has been replaced by the Microsoft Windows Malicious Software Removal Tool. For additional information about the Malicious Software Removal Tool, click the following article number to view the article in the Microsoft Knowledge Base: 890830 (http://support.microsoft.com/kb/890830/ )
    The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000.

    So.... download KB890830.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  5. #5
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    4,752
    Thanks
    171
    Thanked 650 Times in 573 Posts
    Quote Originally Posted by DocWatson View Post
    So.... download KB890830.
    But that's a totally different tool. I don't see how it could help with uninstalling KB833330.

    MSRT (KB890830) is something we all get and run every month from Windows Update.

    Bruce

  6. #6
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    Quote Originally Posted by BruceR View Post
    But that's a totally different tool. I don't see how it could help with uninstalling KB833330.

    MSRT (KB890830) is something we all get and run every month from Windows Update.

    Bruce
    Removal informationTo remove this tool, use the Add or Remove Programs tool in Control Panel to remove the Windows Blaster Worm Removal Tool (KB833330). System administrators can use the Spunist.exe utility to remove this tool. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB833330$\Spuninst folder. Spuninst.exe supports the following Setup switches:

    If KB833330 can be uninstalled, but perhaps a workaround can disable it.

    From here....."You must have the 823980 security update or the 824146 security update installed. During the installation of KB833330.exe, Setup verifies that one of these security updates is installed by checking the version of the Rpcss.dll file on your computer. If the version of this file on your computer is earlier than the version that is documented in Microsoft Knowledge Base article 823980, the installation does not succeed."

    "Blastcln.exe will only run on computers that meet the prerequisites."

    So, if you remove one of the prerequisite updates that should disable the tool.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  7. #7
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    4,752
    Thanks
    171
    Thanked 650 Times in 573 Posts
    Quote Originally Posted by DocWatson View Post
    Removal informationTo remove this tool, use the Add or Remove Programs tool in Control Panel to remove the Windows Blaster Worm Removal Tool (KB833330). System administrators can use the Spunist.exe utility to remove this tool. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB833330$\Spuninst folder. Spuninst.exe supports the following Setup switches:
    But we know that folder doesn't exist in this case.


    Quote Originally Posted by DocWatson View Post
    If KB833330 can be uninstalled, but perhaps a workaround can disable it.

    From here....."You must have the 823980 security update or the 824146 security update installed. During the installation of KB833330.exe, Setup verifies that one of these security updates is installed by checking the version of the Rpcss.dll file on your computer. If the version of this file on your computer is earlier than the version that is documented in Microsoft Knowledge Base article 823980, the installation does not succeed."

    "Blastcln.exe will only run on computers that meet the prerequisites."

    So, if you remove one of the prerequisite updates that should disable the tool.
    I don't think that necessarily follows, and in any case those are security patches which prevent remote execution of malicious code like the Blaster and Nachi worms.

    I think it would be safer to take ownership, grant rights, then delete \windows\system32\blastcln.exe as it's obsolete and causing a minor issue:

    (Probably only possible from Safe Mode due to Windows File Protection in XP SP3.)

    How to Delete a Windows [XP] System File


    Bruce
    Last edited by BruceR; 2012-10-10 at 10:51.

  8. #8
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    Opinions vary. I didn't post to get into a back and forth with you, but to help the OP, who doesn't appear to have been back. We can agree to disagree and leave it at that.

    Have a nice day.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  9. #9
    New Lounger
    Join Date
    Feb 2010
    Location
    Canada
    Posts
    10
    Thanks
    0
    Thanked 3 Times in 2 Posts
    Depending on the way blastcln.exe was originally installed, a backup copy can be found in either
    C:\WINDOWS\ServicePackFiles\i386 or in
    C:\WINDOWS\System32\dllcache
    Both of the above are hidden systems folders so you will have to set Windows Explorer options to display those files.
    Once you find YOUR backup copy, delete the backup first - then delete the version in C:\Windows\System32.
    Since now there is no longer a backup, your system will not be able to re-create the pesky thing from backup.

  10. The Following 2 Users Say Thank You to TheAncient For This Useful Post:

    BruceR (2012-10-13),royw (2013-05-14)

  11. #10
    New Lounger
    Join Date
    Dec 2009
    Location
    Santa Rosa, California, USA
    Posts
    3
    Thanks
    0
    Thanked 1 Time in 1 Post
    There is one more place that blastcln.exe could befound. It is in C:\System32\Prefetch. If you remove all of the backups (usually 2), and then the main file in C:\System32, it will be gone.

  12. The Following User Says Thank You to lhatten For This Useful Post:

    BruceR (2012-10-23)

  13. #11
    Lounger
    Join Date
    Dec 2009
    Location
    NSW
    Posts
    34
    Thanks
    2
    Thanked 0 Times in 0 Posts
    I'm not sure if it's OK to pick up this thread again after it seems to have been fixed, but if not please re-direct my post to the appropriate place.

    Having the same problem I deleted the blastcln.exe file from:
    C:\Windows\ServicePackFiles\i386 as suggested above.

    C:\Windows\System32\dllcache (doesn’t exist on my PC, even with hidden files shown).

    The thread also said to delete it from C:\System32\Prefetch but this doesn’t exist on my PC. (Windows\Prefetch does but the file isn’t in there either).

    When I then delete the file from C:\Windows\System32 it regenerates itself within seconds.

    Can anyone give me a simple solution, short of ignoring it on the Secunia scan? Thanks.

  14. #12
    New Lounger
    Join Date
    Apr 2010
    Location
    San Francisco, CA, USA
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Smile Getting Rid of blastcln.exe

    By using everything.exe (from voidtools.com) to display all copies of blastcln.exe,
    they can be simultaneously selected and "shift/deleted". Windows will protest and pop up several dire warnings about system files, so just click through those, and blastcln.exe will be gone at last!

  15. #13
    New Lounger
    Join Date
    Apr 2010
    Location
    San Francisco, CA, USA
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Addendum to last: Before using everything.exe or equivalent search utility, be sure that Explorer folder preferences are set to display all hidden system files.

  16. #14
    New Lounger
    Join Date
    Nov 2012
    Posts
    2
    Thanks
    0
    Thanked 1 Time in 1 Post
    I searched the Windows folder for blastcln.exe finding four. Then I used Unlocker to rename each to blastcln.exe.end of life. Windows file checker made a protest which I dismissed. Now Secunia doesn't report it anymore. If something goes haywire I can undo the rename I guess.

  17. #15
    Super Moderator jwitalka's Avatar
    Join Date
    Dec 2009
    Location
    Minnesota
    Posts
    6,795
    Thanks
    117
    Thanked 799 Times in 720 Posts
    Before using everything.exe or equivalent search utility, be sure that Explorer folder preferences are set to display all hidden system files
    One of the beauties of Everything search is that it will find hidden and protected Operating system files independent of the current folder preferences settings. If the file is on your PC, Everything search will find it.

    Jerry

Page 1 of 2 12 LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •