W32/Blaster Worm

 Information about the W32/Blaster worm:

W32/Blaster is a DDOS worm. This worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits a vulnerability present in DCOM RPC and spreads using TCP Port 135.

Upon execution of the worm, it modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also creates a mutex called BILLY to check if the worm is already in memory.

On finding a system with this flaw, the worm creates a remote access through TCP 4444 and downloads the file msblast.exe to Windows/Systems32 folder, and executes the file. It also attempts to perform a DDOS attack on the site windowsupdate.com. Windowsupdate.com is a Microsoft site that distributes patches and updates for Windows operating systems.

Microsoft has released a patch for this DCOM RPC vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Protector Plus anti-virus software can detect and remove the W32.Blaster from your system. Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 11th August 2003.

 Other names of W32/Blaster worm:

This worm is also known as W32.Blaster.Worm, WORM_MSBLAST.A, W32/Lovsan.worm