You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Download Cloud Antivirus Gratis

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

Blaster

 
Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:Blaster
Technical name:W32/Blaster
Threat level:Low
Alias:W32/Lovsan.worm, W32.Blaster.Worm, WORM_MSBLAST.A, Win32.Poza, WORM_MSBLAST.H
Type:Worm
Effects:  It launches denial of service attacks against the windowsupdate.com website. It restarts the affected computer.

Affected platforms:

Windows 2003/XP/2000/NT

Detection updated on:Jan. 2, 2004
StatisticsNo
Yes, using TruPrevent Technologies
Repair utility: Panda QuickRemover

Brief Description 

    

Blaster is a worm that affects Windows 2003/XP/2000/NT computers only. Blaster exploits the Buffer Overrun in RPC Interface vulnerability to spread to as many computers as possible.

Blaster launches denial of service (DoS) attacks against the windowsupdate.com website. Whenever the system date is between the days 15 and 31 of every month, or every day during the months September through December of every year, Blaster sends a 40 byte packet every 20 milliseconds, using the TCP port 80.

Blaster spreads by attacking IP addresses generated at random and exploits the vulnerability mentioned above to download a copy of itself to the compromised computer. In order to do this, Blaster incorporates its own TFTP (Trivial File Transfer Protocol) server.

If you have a Windows 2003/XP/2000/NT computer, it is highly recommendable to download the security patch from the Microsoft website. Click here to access the web page for downloading the patch.

Visible Symptoms 

    

Some clear indications that Blaster has reached the computer are the following:

  • The network traffic increases on the TCP 135 and 4444 and UDP 69 ports.
  • The attacked computer blocks and restarts, due to programming errors in the code of the worm.