W32/Blaster.H is a DDOS worm. This worm is a variant of W32/Blaster. This worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits a vulnerability present in DCOM RPC and spreads using TCP Port 135.

Upon execution of the worm, it creates a remote access through TCP 135 and downloads the file mschost.exe to Windows/Systems32 folder, and executes the file. It also attempts to perform a DDOS attack on the site windowsupdate.com. Windowsupdate.com is a Microsoft site that distributes patches and updates for Windows operating systems.

It modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also creates a mutex called BILLY to check if the worm is already in memory.

Microsoft has released a patch for this DCOM RPC vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 3rd February 2003.

Other names of W32/Blaster.H worm:

This worm is also known as W32.Blaster.H Worm, WORM_MSBLAST.H, W32/Lovsan.H worm