W32/Blaster.E Worm

 Information about the W32/Blaster.E worm:

W32/Blaster.E is a DDOS worm. This worm is a variant of W32/Blaster. This worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits a vulnerability present in DCOM RPC.
Upon execution of the worm, it modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Windows Automation

It also creates a mutex called SILLY.

On finding a system with this flaw, the worm creates a remote access through TCP 4444 and downloads the file mslaugh.exe to Windows/System32 folder, and executes the file. It also attempts to perform a DDOS attack on the site kimble.org.

This worm first appeared on 28th August 2003.

 Other names of W32/Blaster.E worm:

This worm is also known as W32.Blaster.E.Worm, W32/Blaster-E, W32/Lovsan.worm.e