Blaster Worm not being cured by normal Microsoft solution or Symantic's FixBlast

Depending upon your OS you may need to disable system restore, apply MS patches, run Anti-Virus updates, then run removal program.  RWB

If you run a firewall as Microsoft recommends, then you will no longer be the subject of reinfections from any variant. Check out Sygate or ZoneAlarm, they are popular here.  I think the links from SunRay should validate well that the firewall is step #1, before dealing with the virus and the patch.

For the patch, make sure you have admin rights or you'll get the error. If you continue having trouble with MS patch, then remove (disable) RPC, the Remote Contol process of the OS that seems more useful to malware than to users.

For removal, without checking any website, my recollection is that there is only a single file to this series, so all you have to do for any variant is identify the name and remove it from startup. Per Norton, the original strains did not restore, so they often left a few files of that name for garbage collection on some other day.

Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. There are at least two known ways to work around this, although neither solution works completely all the time.

If you run Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This action may also work with other firewalls, although this has not been confirmed.

In many cases, on both Windows 2000 and XP, changing the settings of the Remote Call Procedure (RPC) service may allow you to connect to the Internet without the computer shutting down.

Follow these steps:
a. Do one of the following:
    Windows 2000: Right-click the My Computer icon on the Windows desktop, and then click Manage.  The Computer Management window opens.
    Windows XP: Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.

b. In the left pane, double-click Services and Applications, and then select Services. A list of services appears.
c. In the right pane, locate the Remote Procedure Call (RPC) service.

   CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

d. Right-click the Remote Procedure Call (RPC) service, and then click Properties.
e. Click the Recovery tab.
f. Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
g. Click Apply, and then click OK.

-----------------------------------------------------------------

3. Ending the Worm process

To end the Trojan process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for Enbiei.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.

-----------------------------------------------------------------

5. Reversing the changes made to the registry

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"www.hidro.4t.com"="enbiei.exe"

-----------------------------------------------------------------

Note: MS Windows Explorer is also a good search tool, so I use it to search for filenames such as that. It is much quicker than a virus scan. Whoever it is that was "enbiei" has now had their moment of fame, so go ahead and remove it.

Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. There are at least two known ways to work around this, although neither solution works completely all the time.

If you run Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This action may also work with other firewalls, although this has not been confirmed.

In many cases, on both Windows 2000 and XP, changing the settings of the Remote Call Procedure (RPC) service may allow you to connect to the Internet without the computer shutting down.

Follow these steps:
a. Do one of the following:
    Windows 2000: Right-click the My Computer icon on the Windows desktop, and then click Manage.  The Computer Management window opens.
    Windows XP: Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.

b. In the left pane, double-click Services and Applications, and then select Services. A list of services appears.
c. In the right pane, locate the Remote Procedure Call (RPC) service.

   CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

d. Right-click the Remote Procedure Call (RPC) service, and then click Properties.
e. Click the Recovery tab.
f. Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
g. Click Apply, and then click OK.

-----------------------------------------------------------------

3. Ending the Worm process

To end the Trojan process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for Enbiei.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.

-----------------------------------------------------------------

5. Reversing the changes made to the registry

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"www.hidro.4t.com"="enbiei.exe"

-----------------------------------------------------------------

Note: MS Windows Explorer is also a good search tool, so I use it to search for filenames such as that. It is much quicker than a virus scan. Whoever it is that was "enbiei" has now had their moment of fame, so go ahead and remove it.

Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. There are at least two known ways to work around this, although neither solution works completely all the time.

If you run Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This action may also work with other firewalls, although this has not been confirmed.

In many cases, on both Windows 2000 and XP, changing the settings of the Remote Call Procedure (RPC) service may allow you to connect to the Internet without the computer shutting down.

Follow these steps:
a. Do one of the following:
    Windows 2000: Right-click the My Computer icon on the Windows desktop, and then click Manage.  The Computer Management window opens.
    Windows XP: Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.

b. In the left pane, double-click Services and Applications, and then select Services. A list of services appears.
c. In the right pane, locate the Remote Procedure Call (RPC) service.

   CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

d. Right-click the Remote Procedure Call (RPC) service, and then click Properties.
e. Click the Recovery tab.
f. Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
g. Click Apply, and then click OK.

-----------------------------------------------------------------

3. Ending the Worm process

To end the Trojan process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for Enbiei.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.

-----------------------------------------------------------------

5. Reversing the changes made to the registry

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"www.hidro.4t.com"="enbiei.exe"

-----------------------------------------------------------------

Note: MS Windows Explorer is also a good search tool, so I use it to search for filenames such as that. It is much quicker than a virus scan. Whoever it is that was "enbiei" has now had their moment of fame, so go ahead and remove it.

we got it sunbow! lol

From SOPHOS:

To remove W32/Blaster-F manually on Windows 95/98/Me and Windows
NT/2000/XP:


ensure you have installed Microsoft patch MS03-026.


press Ctrl+Alt+Del


in Windows NT/2000/XP click Task Manager and select the
Processes tab


look for a process named enbiei.exe in the list


click the process to highlight it


click the 'End Process' (in Windows 95/98/Me 'End Task')
button


close Task Manager.

Search for the file enbiei.exe in the Windows system
folder (usually a subfolder of Windows or WINNT) and delete it.

In Windows NT/2000/XP you will also need to edit the following
registry entry. The removal of this entry is optional in Windows
95/98/Me. Please read the warning about editing the registry.



At the taskbar, click Start|Run. Type 'Regedit' and press
Return. The registry editor opens.


Before you edit the registry, you should make a backup. If in doubt,
contact your network administrator. Incorrect editing of the
Windows Registry can cause system failure.


Locate the HKEY_LOCAL_MACHINE entry:


HKLM\Software\Microsoft\Windows\CurrentVersion\Run

and remove any reference to any file you deleted.



Close the registry editor.


You should reboot your computer and repeat the above process to
ensure all traces of the worm have been removed from your
system.

Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. There are at least two known ways to work around this, although neither solution works completely all the time.

If you run Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This action may also work with other firewalls, although this has not been confirmed.

In many cases, on both Windows 2000 and XP, changing the settings of the Remote Call Procedure (RPC) service may allow you to connect to the Internet without the computer shutting down.

Follow these steps:
a. Do one of the following:
    Windows 2000: Right-click the My Computer icon on the Windows desktop, and then click Manage.  The Computer Management window opens.
    Windows XP: Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.

b. In the left pane, double-click Services and Applications, and then select Services. A list of services appears.
c. In the right pane, locate the Remote Procedure Call (RPC) service.

   CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.

d. Right-click the Remote Procedure Call (RPC) service, and then click Properties.
e. Click the Recovery tab.
f. Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
g. Click Apply, and then click OK.

-----------------------------------------------------------------

3. Ending the Worm process

To end the Trojan process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for Enbiei.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.

-----------------------------------------------------------------

5. Reversing the changes made to the registry

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"www.hidro.4t.com"="enbiei.exe"

-----------------------------------------------------------------

Note: MS Windows Explorer is also a good search tool, so I use it to search for filenames such as that. It is much quicker than a virus scan. Whoever it is that was "enbiei" has now had their moment of fame, so go ahead and remove it.

(footer: I've had trouble all day getting the server access, and those comments to 'take')

Just to add a comment to this, Bill_Pardoe, you said in your post that "I have upgraded to W2000 SP4. I assume that the fix is included in SP4"
Surprise! The patch that prevents the DCOM/RPC exploit that Blaster uses (Security Update MS03-039) is a POST SP4 patch. It came out AFTER SP4 for Win2K did. It will be included in SP5, but that is not out.
So, even with SP4 on, you still need to get and apply the patch. Go with the links sunray included to get the patch.

I agree. I hadn't enough caffeine to remember well, thought I'd leave that to others, since it sounded recent. What I recall is that the patch would work on SP-3 and SP-4, but was at least at first unreliable on SP-2.  Probably unreliable for some other configurations as well.  I remember it was also superceded, so you'd best get the most recent one, due to all the other exploits.

I believe though, that after this much time it was included in a roll-up of patches.  In any case, if you want to connect to internet, do please upgrade to install patches to all of the weekly vulnerabilities, we are getting real tired of people not doing this and hitting us with increasing maladies - so much that some businesses (I was in one) can and will unplug you from internet, even if you are in a major company.  That kind of power no longer helps. If you (anyone) are identified as contributing to the RPC malware traffic, you may find that traffic censored, as well as any other traffic you attempt, including eMail, etc.

I just visited Symantec site, and while it lists version F as a minor problem, it still calls the original a MAJOR threat, beware.