Forum Thread: false end-of-life when Blaster tool is part of a package

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft Removal Tool: Blaster/Nachi

This thread has been marked as locked.
metaed false end-of-life when Blaster tool is part of a package
Member 12th Oct, 2012 19:32
Ranking: 1
Posts: 110
User Since: 11th Feb, 2009
System Score: N/A
Location: US
Last edited on 12th Oct, 2012 19:33

I have read the (very helpful) advice on how to work around the Blaster/Nachi end-of-life alert.

Many XP systems with the file blastcln.exe do not have the standalone patch KB833330 installed. They got the file as part of a package, such as a service pack. The standalone patch is end-of-life, but not these other packages. For example, Windows 7's "Windows XP Mode" installs this file.

This leads to two points:

1. PSI should only report the presence of blastcln.exe as an end-of-life alert on XP when the system has the standalone patch installed.

2. The Microsoft uninstall instructions for blastcln.exe which can be found elsewhere in these forums are actually instructions for removing the standalone patch. This is why they do not work on a system which got the file as part of a package.

--
Sometimes they fool you by walking upright.

mathermw RE: false end-of-life when Blaster tool is part of a package
Member 14th Oct, 2012 15:30
Score: 1
Posts: 2
User Since: 9th Jul 2008
System Score: N/A
Location: N/A
Received as part of a SP is exactly my situation on my XP Pro machine.

Telling folks to ignore the file is a poor solution, as it leaves one open to possible future exploits.

Secunia PSI team, I hope you are working on a modification to properly address this?

Thanks.
Was this reply relevant?
+0
-0
SteveSecunia14 RE: false end-of-life when Blaster tool is part of a package
Member 14th Oct, 2012 16:47
Score: 4
Posts: 30
User Since: 10th Oct 2012
System Score: N/A
Location: US
Cause: Microsoft has stop supporting that version of the tool.

I was having the same problem on my xp sp3 home addition pc. Until I did this

Fix:
Reboot your pc into safemode.
log on to your account.
Do a search for the File: blastcln
Set up the search results as follows.
Click on All files and folders.
where it says: (All or part of the file name) type in blastcln
where it says: (Look in) select My Computer
where it says: (More advanced options put a check mark in:
Search system folders
Search hidden files and folders
Search subfolders
Click on search.
After the search has finished. Delete all files found. Then empty the recycle bin.
Reboot
Run a PSI full scan.
You should have no more problems with MSRT Blaster/Nachi and Secunia
Was this reply relevant?
+5
-1
BankerBOE2 RE: false end-of-life when Blaster tool is part of a package
Member 14th Oct, 2012 22:07
Score: 3
Posts: 19
User Since: 19th Dec 2008
System Score: N/A
Location: UK
Spot on, SteveSecunia14. Works a dream, even though XP Home Sp3 has slightly different search prompts.


--
Windows 7 Professional 64-bit SP1
AMD A8-5600k APU w/Radeon HD Graphics 3.60 GHz
Internet Explorer 11, Firefox
16Gb RAM, 1Tb HD
Was this reply relevant?
+1
-0
This user no longer exists RE: false end-of-life when Blaster tool is part of a package
Secunia Official 15th Oct, 2012 14:25
on 14th Oct, 2012 15:30, mathermw wrote:

Secunia PSI team, I hope you are working on a modification to properly address this?


The PSI is simply informing that the program is no longer supported by Microsoft, and that it has been replaced by the Microsoft Windows Malicious Software Removal Tool. This is a Microsoft decision and stated on their website.
http://support.microsoft.com/?kbid=833330

We understand the frustration this can cause for our PSI users with Windows XP and can only hope Microsoft will address the issue soon.
Starry Might RE: false end-of-life when Blaster tool is part of a package
Member 15th Oct, 2012 16:04
Score: 2
Posts: 2
User Since: 10th Jul 2011
System Score: N/A
Location: US
I've decided today that based on what I've read here, I should go ahead and deal with the problematic Blaster/Nachi tool instead of just Ignoring it.

As I typed this, I followed SteveSecunia14's instructions...and it worked!

Thanks, Steve!

--
~*~ Star light, star bright, I am Starry Might! ~*~
Was this reply relevant?
+1
-0
SteveSecunia14 RE: false end-of-life when Blaster tool is part of a package
Member 17th Oct, 2012 06:34
Score: 4
Posts: 30
User Since: 10th Oct 2012
System Score: N/A
Location: US
Thanks, BankerBOE2,
Happy to hear you no longer have this issue.
Steve
Was this reply relevant?
+0
-0
SteveSecunia14 RE: false end-of-life when Blaster tool is part of a package
Member 17th Oct, 2012 06:38
Score: 4
Posts: 30
User Since: 10th Oct 2012
System Score: N/A
Location: US
Thanks, Starry Might
Glad I could help you with this issue.
Steve
Was this reply relevant?
+0
-0
mathermw RE: false end-of-life when Blaster tool is part of a package
Member 18th Oct, 2012 03:04
Score: 1
Posts: 2
User Since: 9th Jul 2008
System Score: N/A
Location: N/A

Your answer: "The PSI is simply informing that the program is no longer supported by Microsoft, and that it has been replaced by the Microsoft Windows Malicious Software Removal Tool. This is a Microsoft decision and stated on their website.
http://support.microsoft.com/?kbid=833330"

You are not addressing the point of this thread. I and others do not have the patch from kb833330 installed. The blastcln.exe tool was apparently installed as part of a service pack. That service pack is NOT in "end-of-life" status (and reinstalls the file if you try to remove it). I know this could be seen as inconsistent of Microsoft, but that is the present status.

Secunia's options would appear to be to adjust PSI to account for this, or not. If you feel that there are not enough XP machines using PSI to make this worthwhile, then just say so...
Was this reply relevant?
+1
-0
metaed RE: false end-of-life when Blaster tool is part of a package
Member 19th Oct, 2012 00:00
Score: 1
Posts: 110
User Since: 11th Feb 2009
System Score: N/A
Location: US
Yes, mathermw understands the issue correctly.

It is factually incorrect to say that the file blastcln.exe is end-of-life.

The file is installed by patch KB833330, which is end-of-life, but the same file is also installed by current XP service packs, which are not end-of-life. This why it is an error to use the presence of blastcln.exe as a proxy for the presence of patch KB833330.

PSI ought to detect the presence of patch KB833330 some other way, or else it ought to not detect blastcln.exe at all until such time as Microsoft retires all patches and service packs which provide it.

--
Sometimes they fool you by walking upright.
Was this reply relevant?
+1
-0

This thread has been marked as locked.