It launches denial of service attacks against the kimble.org website, which points to the IP address 127.0.0.1, and therefore the affected computer is actually attacking itself. It restarts the computer.

Windows XP/2000/NT

Blaster.E is a worm that infects only Windows 2003/XP/2000/NT computers. Blaster.E exploits the Buffer Overrun in RPC Interface vulnerability to spread to as many computers as possible.

Blaster.E launches denial of service (DoS) attacks against the kimble.org website. Whenever the system date is between the days 15 and 31 of every month, or every day during the months September through December of every year, Blaster.E sends a 40 byte packet every 20 milliseconds, using the TCP port 80.

The attacked website points to the IP address 127.0.0.1, and therefore the affected computer is actually attacking itself.

Blaster.E spreads by attacking IP addresses generated at random and exploits the vulnerability mentioned above to download a copy of itself to the compromised computer. In order to do this, Blaster.E incorporates its own TFTP (Trivial File Transfer Protocol) server.

If you have a Windows 2003/XP/2000/NT computer, it is highly recommendable to download the security patch from the Microsoft website. Access the web page for downloading the patch.

Some clear indications that Blaster.E has reached the computer are the following:

• The network traffic increases on the TCP 135 and 4444 and UDP 69 ports.
• The attacked computer blocks and restarts, due to programming errors in the code of the worm.