W32/Blaster.D Worm

 Information about the W32/Blaster.D worm:

W32/Blaster.D is an internet worm. This worm is a variant of W32/Blaster. This worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits a vulnerability present in DCOM RPC and WebDAV.

Upon execution of the worm, the worm copies itself as dllhost.exe to Winnt/System32/wins folder. It creates a mutex called RPCPatch_Mutex to check if the worm is already in memory. It also copies tftpd.exe to Windows/System32/wins folder as svchost.exe and creates a service as 'Network Connections Sharing'. When this service is run, the affected system will be a tftpd server, which allows other vulnerable system on the network to download this worm.

The worm scans for random IP addresses on the network for vulnerable systems. The worm opens port 707 in the infected system to spread itself to other systems. This worm also checks for the presence of W32/Blaster and terminates its activity by removing this worm completely. The worm deletes itself when the system year becomes 2004.

The worm carries various links for DCOM RPC vulnerability patch and it also attempts to download and apply the patch.

Microsoft has released a patch for this DCOM RPC vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 18th August 2003.

 Other names of W32/Blaster.D worm:

This worm is also known as WORM_MSBLAST.D, W32/Nachi-A, Lovsan.D, W32.Welchia.