How to Remove Eblaster

Eblaster, short for Spyware.Eblaster, is spyware that tracks keystrokes, email and IM usage. It periodically sends an email with your personal data to a predefined address. It can attach itself to a file and infect your system if you execute the file, so anyone who received emails with file attachments or downloads files via the internet or external media is at risk. Eblaster can attack any version of Windows. The only way you would be likely to detect the presence of Eblaster is via antivirus or spyware detection software. You should destroy Eblaster as soon as possible after detection to minimize data insecurity.

Instructions

1. Update your definitions in your antivirus software and scan your system. Reboot. If you don't have antivirus software, proceed to Step 3.

2. Rescan your system. If it finds eblaster again, install and run Spybot and Ad-Aware (See Resources below). Reboot and repeat virus scan. Whether they find and delete eblaster or not, proceed to the following steps to assure that it's gone.

3. Select control/alt/delete and end the following processes: eblaster.exe, msrac32.exe, and ebsetup.exe.

4. Launch the registry: select "Start" and click "Run." Type "regedit" (without quotation marks), and hit "Enter." Navigate to the following keys and delete them:

   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
   ShellServiceObjectDelayLoad\XmLdrKLocation = {0C887F38-5178-43DA-B9F0-B856141FCDA4}

   HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{0C887F38-5178-43DA-B9F0-B856141FCDA4}

   HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{2BE166ED-F16C-46DE-B623-3575FD985D6D}

   HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{6A6A1EAE-13E1-4DC7-8014-B7677EF6D47A}

5. Exit the registry. Reboot and repeat virus scan. Re-run SpyBot and Ad-Aware to verify that it's gone.

Tips & Warnings

• Eblaster can cloak itself under a variety of names and even recreate deleted registry keys under another name to make detection difficult. For this reason, it is necessary to re-check for its presence repeatedly.

Resources

• Spybot Search & Destroy
• Ad-Aware