W32/Blaster.D Worm

Download free anti virus software

Anti virus software information

Order anti virus software (US$ 29.95)

Protector Plus
Anti virus software for

Windows
(XP, 2000, 2003, NT, Me, 98, 95)

Exchange

NetWare

W32/Blaster.D Worm

Information about the W32/Blaster.D Worm:

W32/Blaster.D is an internet worm. This worm is a variant of W32/Blaster. This worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits a vulnerability present in DCOM RPC and WebDAV.

Upon execution of the worm, the worm copies itself as dllhost.exe to Winnt/System32/wins folder. It creates a mutex called RPCPatch_Mutex to check if the worm is already in memory. It also copies tftpd.exe to Windows/System32/wins folder as svchost.exe and creates a service as 'Network Connections Sharing'. When this service is run, the affected system will be a tftpd server, which allows other vulnerable system on the network to download this worm.

The worm scans for random IP addresses on the network for vulnerable systems. The worm opens port 707 in the infected system to spread itself to other systems. This worm also checks for the presence of W32/Blaster and terminates its activity by removing this worm completely. The worm deletes itself when the system year becomes 2004.

The worm carries various links for DCOM RPC vulnerability patch and it also attempts to download and apply the patch.

Microsoft has released a patch for this DCOM RPC vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 18th August 2003.

Other names of W32/Blaster.D worm:

This worm is also known as WORM_MSBLAST.D, W32/Nachi-A, Lovsan.D, W32.Welchia.

Click here to download a 30 day Evaluation Copy of
Protector Plus anti virus for your operating system

About Protector Plus Anti virus Software Packages:

Proland Software is the developer of Protector Plus range of anti virus software packages. Protector Plus anti virus is available for Windows XP, Windows Me/98/95, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of anti virus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus antivirus software can detect and remove W32/Blaster.D worm reliably.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

You can download the 30 day evaluation copy of
Protector Plus anti virus software free of cost for these platforms:

Windows | Exchange | NetWare

Download free anti virus software | Anti virus software information | Order anti virus software