$ 11.99|https://store.pandasecurity.com/300/purl-vpn?currencies=USS&x-track=55499&cart=iA001PVPNS05&language=en&quantity=1&enablecoupon=false&coupon=1STMOFFPD&x-coupon=1STMOFFPD&x-market=usa&x-track=190478|$ 0.00|$;PREFIX;.;,;11;99;0;00

It ends in:

Days Hours Minutes

It ends in:

Days Hours Minutes

The best protection with a 60% discount

Apply discount

Get 40% discount! Discover the plan that suits you best!

See offer

Get 40% discount! Discover the plan that suits you best!

See offer

Renew and get 50% off*

Only available for 48 hours!

::

*For home users only

Renew at a discount
::

Renew and get 50% off*

Renew
*Home users only

*For home users only Renew and get 50% off*

::
Renew

Special offer: Renew and get 50% off**

Only available for 48 hours!

::

*For home users only

Renew at a discount

*For home users only Special offer: Renew and get 50% off*

::04
Renew

Hello!

You’re about to visit our web page in English
Would you like to continue?

Yes, I want to visit the web page in English No, I want to visit the web page in

If this is not what you’re looking for,

Visit our Welcome Page!

Call us 24/7 and get a free diagnosis 951 203 528

Active Scan. Scan your PC free

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Blaster

 
Threat LevelModerate threatDamageHighDistributionNot widespread

Effects 

Blaster has the following effects:

  • It launches denial of service (DoS) attacks against the windowsupdate.com website whenever the system date is between the days 15 and 31 of every month, or every day during the months September through December of every year.
  • It can block and restart the attacked computer, due to programming errors in the code of the worm.
  • It increases the network traffic on the TCP 135 and 4444, and UDP 69 ports.

Infection strategy 

Blaster creates the file MSBLAST.EXE in the Windows system directory. This file is a copy of the worm.

Blaster creates the following entry in the Windows Registry:

  • HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
    windows auto update = msblast.exe

    By creating this entry, Blaster ensures that it is run whenever Windows is started.

Blaster follows the infection routine below:

  • The worm creates a mutex called BILLY in order to check if it is already activated. Blaster checks that the version of Winsock is 1.00, 1.01 or 2.02, and that a connection to the Internet is available. If it is not, Blaster checks for an Internet connection every 20 seconds.
  • Blaster generates IP addresses at random, first within the network of the computer on which it is running, and then in class B networks (networks whose mask is 255.255.0.0).
  • Blaster attempts to exploit the Buffer Overrun in RPC Interface vulnerability in the remote computer, identified by the IP address generated.
  • If successful, Blaster logs on remotely, and opens a connection from the TCP 4444 port of the affected computer to the UDP 69 port of the attacking computer.
  • Once the connection is established, the attacking computer sends a copy of the worm via TFTP. The worm incorporates its own TFTP server.
  • Once the download is completed, the file sent is run remotely, and as a result the worm can spread from the attacked computer.

Means of transmission 

Blaster spreads by attacking IP addresses generated at random. These IP addresses belong to the computers in the same network as the attacked computer, as well as B class networks (whose mask is 255.255.0.0).

Blaster attempts to exploit the Buffer Overrun in RPC Interface vulnerability in those computers. If successful, it downloads a copy of itself to the attacked computer. Blaster incorporates its own TFTP server.

Further Details  

Blaster is written in the Assembler language. This worm is 6,176 bytes in size when it is compressed with UPX, and 11,296 bytes in size once decompressed.

The code of Blaster contains several text strings, which are not displayed at any time:
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!

>

ARE YOU FACING ANY PC OR INTERNET RELATED PROBLEMS?
FREE SUPPORT INCLUDED. CALL US 24/7

powered by Anytech365