Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft Removal Tool: Blaster/Nachi

This thread has been marked as locked.
Maurice Joyce Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 6th Oct, 2012 22:53
Ranking: 11560
Posts: 8,884
User Since: 4th Jan, 2009
System Score: N/A
Location: UK
There are a few threads appearing on the Forum on this topic. Hopefully this will help.

Secunia have recently updated their database which indicates that The Microsoft Removal Tool for Blaster/Nachi is End of Life.

If the path to the offending file is checked it should read C:\WINDOWS\system32\blastcln.exe with version number 5.1.2600.5512

This notification by Secunia should only affect those using Windows XP.

The Microsoft Removal Tool for Blaster/Nachi should not be confused with its replacement which is called the Windows Malicious Software Removal Tool and runs via the monthly Windows Update cycle.

If the Windows Update history is checked an entry like this should be seen which means the system is up to date:
https://akkkug.bay.livefilestore.com/y1p8uO3AMycZP...

Microsoft details regarding this issue are here:

Blaster/Nachi
http://support.microsoft.com/kb/833330

Windows Malicious Software Removal Tool
http://www.microsoft.com/en-gb/security/pc-securit...

Before taking any action please note that Secunia have declared it End of Life but there is no suggestion that it is vulnerable.

On that basis there are a few options to remove the notification.

1. Do absolutely nothing & allow PSI to show it as End of Life.

2. Create an Ignore Rule with the tool provided by PSI.

3. Navigate to the file in Windows explorer & rename it blastcln.exe-OLD

4. Try to uninstall it (this does not work for me)using the advice given by Microsoft as follows:

To remove this tool, use the Add or Remove Programs tool in Control Panel to remove the Windows Blaster Worm Removal Tool (KB833330). System administrators can use the Spunist.exe utility to remove this tool. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB833330$\Spuninst folder. Spuninst.exe supports the following Setup switches: /? Show the list of installation switches.
/u Use Unattended mode.
/f Force other programs to quit when the computer shuts down.
/z Do not restart when the installation is complete.
/q Use Quiet mode (no user interaction).

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM

MisterCat RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 7th Oct, 2012 20:31
Score: 0
Posts: 11
User Since: 12th Sep 2010
System Score: N/A
Location: US
Thank you, Maurice, for posting those instructions. My problem is now solved! I created an ignore rule named "ignore blastcln.exe" with the path being "C:\WINDOWS\system32\blastcln.exe" and that bothersome file is now being dutifully ignored by PSI Version 2.0.0.4003. I've a clean slate once more!

I tried your re-naming suggestion ("blastcln.exe-OLD") but the operating system promptly created a new "blastcln.exe". It's a pity Microsoft hasn't created a widget of some sort to remove "blastcln.exe" but perhaps that'll happen in the fullness of time. In the event, the ignore rule works just fine. Thanks again!

--
'Beauty is the purgation of superfluities.' - Michelangelo Buonarroti
Was this reply relevant?
+0
-0
martyhalpern RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 04:37
Score: 5
Posts: 10
User Since: 9th Jul 2008
System Score: N/A
Location: US
I don't mean to appear obtuse, but with the PSI version I'm running, I can't even tell what version it is. And there is no option to enter an ignore rule like there was with the older version of PSI. The only options I have are at the very bottom of the window: Scan Again button; my user profile and link to this forum; History; Settings (start on boot, install updates automatically, or scan an individual drive); and lastly a Share option (FB & Twitter).

If you can tell me where to look for the version number and also where to enter an ignore rule, I'd be happy to do this to resolve this "blastcln.exe" issue.

-martyh
Was this reply relevant?
+1
-0
nvsoar RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 07:38
Score: 2
Posts: 6
User Since: 16th May 2010
System Score: N/A
Location: US
Windows XP_SP3;
If you really want to get rid of it -
Search all files including system files for "blast"; no quotes
Delete all blastcln.??? and BLASTCLN.??? files that show up in the search results - can be done from the search results window
Delete blastcln.exe. from the windows/system32 folder
Empty the recycle bin
Worked for me.
Was this reply relevant?
+2
-0
Maurice Joyce RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 8th Oct, 2012 10:19
Score: 11560
Posts: 8,884
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@martyh

Looks like you are running version 3.

PSI VERSION 3

Open PSI>Activate "Show Programs">From the list of Programme Icons that appear right click on the programme(s) you wish to ignore & select "Ignore Updates To This Program"

The icon will be moved from the main list & recreated at the bottom of the page under the heading "Programs That Do Not Receive Updates".

Any programme in this category can be returned the the main Program List with a right click & selection of "Don't Ignore Updates To This Program".


--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+5
-0
Gerrysea RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 13:34
Score: 0
Posts: 5
User Since: 7th Sep 2009
System Score: N/A
Location: N/A
Literally tried everything suggested here, only thing that works in the ignore updates trick, but that's not really an answer. What happens if the status for this software is ever changed from End of Life to Insecure?

Surely there must be an answer to this problem?
Was this reply relevant?
+0
-0
Maurice Joyce RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 8th Oct, 2012 15:32
Score: 11560
Posts: 8,884
User Since: 4th Jan 2009
System Score: N/A
Location: UK
That file is managed by Microsoft. If it ever became insecure I am sure they would produce a fix it tool other than the one currently in circulation that does not work for me.

I have just left it "as is" - if that does not suit you it may be better to contact Microsoft Support.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+3
-0
Gerrysea RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 15:41
Score: 0
Posts: 5
User Since: 7th Sep 2009
System Score: N/A
Location: N/A
"contact Microsoft Support.", Yep, perhaps we give that a try, see what they have to say? Anyway, thanks for your response.
Was this reply relevant?
+0
-0
Starry Might RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 15:50
Score: 2
Posts: 2
User Since: 10th Jul 2011
System Score: N/A
Location: US
Hello, everyone! I had this problem the other day, and it drove me nuts!

This morning, after some Google searching, I found this page...thanks for the info, Maurice!

I just went ahead and told the PSI to ignore it.

--
~*~ Star light, star bright, I am Starry Might! ~*~
Was this reply relevant?
+1
-0
joe schmoe RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 21:31
Score: 38
Posts: 139
User Since: 26th Nov 2008
System Score: 100%
Location: US
@ Maurice,

Thank you for the info.

Did not do anything about it, as I figured that. I downloaded the same September MRT file, ran that, and no change. After that, figured it was indeed an obsolete file, and decided to leave it alone.

Sometimes it is best not to do anything after checking it out, especially when not marked as vulnerable by PSI. Detection is valid, and despite appearances, remains so.

--
XP Pro SP3 P4 3.2 HT 2 GB RAM Avast! 9.0.2018 AIS
Win 7 Home Pro SP1 Pentium D 2.8 3 GB RAM Avast 9.0.2018 AIS
Secunia PSI 2.0.0.3003 XP Pro 32-bit & Win 7 H Pro 64-bit
Was this reply relevant?
+0
-0
martyhalpern RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 8th Oct, 2012 21:39
Score: 5
Posts: 10
User Since: 9th Jul 2008
System Score: N/A
Location: US
Last edited on 8th Oct, 2012 21:41
Just an FYI: I renamed the file "blastcln.exe-OLD" as suggested, and then reran PSI, and it still found the file as needing to be updated. So I searched for the file again in my Windows system folder, and not only did I find the renamed "Old" file, but a new file had been created with the original name "blastcln.exe"! So it appears that there is something in Windows XP system files that will regenrate this no matter what. I deleted the "Old" file, left the new one as is just in case Msft ever gets around to actually doing something about this file, and then followed the steps to simply ignore the update.

- martyh
Was this reply relevant?
+1
-0
aaaaaaaaaaaaaaaaa RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 9th Oct, 2012 23:12
Score: -5
Posts: 41
User Since: 15th Dec 2008
System Score: 100%
Location: N/A

I have a XP SP3 machine with psi 2.0 on it here.
blastcln.exe is also reported as end-of-life.
However, I neither find the entry "Add or Remove Programs tool in Control Panel to remove the Windows Blaster Worm Removal Tool (KB833330)" ,
nor %Windir%\$NTUninstallKB833330$.

What's up?
I doubt an ignore rule for this item is a good idea. Some when it will arise to
real vulnerability and one has set ignore rule.
Was this reply relevant?
+1
-0
Maurice Joyce RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 9th Oct, 2012 23:36
Score: 11560
Posts: 8,884
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 10th Oct, 2012 10:58
Do you use a registry cleaner?

EDIT

However, I neither find the entry "Add or Remove Programs tool in Control Panel to remove the Windows Blaster Worm Removal Tool (KB833330)" ,nor %Windir%\$NTUninstallKB833330$.

What's up?


If you use a Registry cleaner these may well have been removed - for example the last time I tested CCleaner such an option existed when using XP.

I think the other point has already been covered in an answer to @Gerrysea (above)

You can leave the notification "as is" - or create an ignore rule. If those options are not to your liking then you should contact Microsoft Support for assistance in full removal.



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+3
-0
Anthony Wells RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Expert Contributor 10th Oct, 2012 14:16
Score: 2414
Posts: 3,310
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Hello ,

I have the .exe file in System 32 which the PSI detected and I have set an ignore rule (the only on I have) .

I do not have a display in Add/Remove nor the "spuninstall" ; it is correct that CCleaner has a (non-default) option to clean these out which I have never used , however I did do a full system reinstall a couple of years ago and most (if not all) KB's prior to this date do not seem to be (re)installed including the one in question . The .exe may recreate itself but "the spuninstall" usually do not , one reason to think hard before getting rid of them .

Not being able to delete the .exe file may be a deliberate ploy (by M$) to protect the "anti-malware" programme from deletion by a bad guy .

Take care

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
Maurice Joyce RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 10th Oct, 2012 14:56
Score: 11560
Posts: 8,884
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Anthony,
The CCleaner was not a default option in my tests rather an advanced one that required activating by the user.

I suspect many of your uninstallers were lost in that I assume you updated direct using SP3 rather than 1 or 2?

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0

Anthony Wells

RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
[+]
This reply has been deleted
snodger RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 11th Oct, 2012 00:20
Score: 1
Posts: 3
User Since: 11th Dec 2008
System Score: 91%
Location: UK
Several posters have been unable to delete the file blastcln.exe from the location C:\WINDOWS\system32\ without the file re-appearing almost immediately. This re-appearance occurs because there is a backup of the file in the location C:\WINDOWS\system32\dllcache, which the OS copies to the system32 folder when the original is deleted.

This is easily overcome by deleting the backup from the dllcache sub-folder before deleting the working copy from the system32 folder. Any warning from the OS about the inadvisability of this action can be ignored; so, if necessary, confirm that you intended to carry it out.
Was this reply relevant?
+2
-2
tdmadden RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 11th Oct, 2012 01:53
Score: 1
Posts: 2
User Since: 21st Oct 2009
System Score: N/A
Location: N/A
there is no dllcache subdireictroy under c:\windows\system32
Was this reply relevant?
+1
-0
Gerrysea RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 11th Oct, 2012 01:59
Score: 0
Posts: 5
User Since: 7th Sep 2009
System Score: N/A
Location: N/A
on 11th Oct, 2012 01:53, tdmadden wrote:
there is no dllcache subdireictroy under c:\windows\system32


Same here!!
Was this reply relevant?
+0
-0
tdmadden RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 11th Oct, 2012 02:03
Score: 1
Posts: 2
User Since: 21st Oct 2009
System Score: N/A
Location: N/A
I edned up adding it in the confiiguratiion as discussed above....no more pronouncements.

I still don't understand why it was idenfied just now....why did Secunia not find it before?
Was this reply relevant?
+0
-0
Anthony Wells RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Expert Contributor 11th Oct, 2012 02:32
Score: 2414
Posts: 3,310
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Hi ,

The .dllcache subfolder is a "hidden" file and is certainly on my system , unfortunately it does not contain a copy of the blastcln file on first (quick) perusal .

Hope that helps .

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
snodger RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 11th Oct, 2012 17:23
Score: 1
Posts: 3
User Since: 11th Dec 2008
System Score: 91%
Location: UK
Please accept my apologies for not providing sufficient detail in my earlier post to enable all posters to deal with this problem.

As Anthony Wells has stated, the dllcache sub-folder, which tdmadden and Gerrysea could not find, is a 'hidden' folder. This can easily be displayed using Folder Options, but I am not going to recommend that. Instead I will suggest a different approach.

Anthony Wells also failed to find the file blastcln.exe in his dllcache sub-folder. Perhaps I should explain why some people will find it there and others will have to look elsewhere for it. The difference comes down to whether Service Pack 3 was installed using your XP CD or whether you obtained it via Microsoft Update or from Download Center. All methods will place the working copy in the system32 folder, but the location for the backup copy will depend on the method used for installing SP3. Using a CD will result in the backup being placed in the dllcache sub-folder, but using Microsoft Update or Download Center should result in the backup being located in the folder C:\WINDOWS\ServicePackFiles\i386.

The important point is to locate the backup file and delete it first; then delete the working copy from the system32 folder. The OS will complain that you are making your system unstable. Ignore this by clicking on the Cancel option.

A simple, and very quick, approach that works however you installed SP3 is to use the Search facility. You should elect to search for 'All files and Folders' and enter blastcln.exe as the file name. Select 'More Advanced Options, and ensure that 'Search system folders', 'Search hidden files and folders' and 'Search subfolders' are all checked. Then, if necessary, on the toolbar, go to View --> Details. This is essential so that you can tell which of the otherwise identical files is which. Then click on Search. Two files should be found with their locations displayed. Delete the backup first, followed by the working copy.

I have probably gone over the top with detail this time, but better that than providing insufficient detail for some, as in my earlier instructions.
Was this reply relevant?
+1
-0
Anthony Wells RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Expert Contributor 11th Oct, 2012 17:41
Score: 2414
Posts: 3,310
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Thank you for the detailed update , the elusive back up file is in the I386 folder and conforms to the way I restored my system .

Will deal with things when I can .

Take care

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
mtodorov RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Member 12th Oct, 2012 09:53
Score: 12
Posts: 166
User Since: 20th Mar 2009
System Score: N/A
Location: HR
Last edited on 12th Oct, 2012 09:54
Probably setting an ignore rule is the safest means to deal with the issue.

Needless to say, I have also deleted the Spuninst directory for the tool with Ccleaner, so ignoring the program seems the safest way, since messing up with blastcln.exe file in system32 dir can void the warranty on OS.

My score is again 100% :-) which sadly isn't shown in my online profile :-/

Rgdz,
mtodorov


--
"If a task is worth doing, it is worth doing right. If it is not worth doing well, it is not worth doing." -- Dr. Jack Hyles
<><
Was this reply relevant?
+0
-1
Maurice Joyce RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 12th Oct, 2012 15:33
Score: 11560
Posts: 8,884
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Blimey - I am surprised XP still appears to have a warranty!

Given what@tdmadden stated your choice of action appears wise. This file has been obsolete since the day that the Windows Malicious Software Removal Tool included XP using Windows Update (which was a long time ago). Why it has just surfaced as a low level issue is a welcomed mystery.

I will close this thread on the basis there is enough information for anyone affected to make their own balanced judgement on an action plan that suits.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
Maurice Joyce RE: Having Problems with the Microsoft Removal Tool for Blaster/Nachi?
Handling Contributor 16th Oct, 2012 16:36
Score: 11560
Posts: 8,884
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I note that this thread is still being actively used so have moved it to the top.

This additional post by SteveSecunia14 elsewhere on the Forum is worthy of note. It is another option that may be worth trying if keen to remove it.

Submitted by SteveSecunia14

Fix:
Reboot your PC into safe mode.
log on to your account.
Do a search for the File: blastcln
Set up the search results as follows.
Click on All files and folders.
where it says: (All or part of the file name) type in blastcln
where it says: (Look in) select My Computer
where it says: (More advanced options put a check mark in:
Search system folders
Search hidden files and folders
Search sub folders
Click on search.
After the search has finished. Delete all files found. Then empty the recycle bin.
Reboot
Run a PSI full scan.
You should have no more problems with MSRT Blaster/Nachi and Secunia


If it works for you & you would like to credit his score the original post is here:

https://secunia.com/community/forum/thread/show/13...

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+3
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability