Blaster
Blaster

Blaster worm starts European campaign

Lovesan/Blaster on the move following US infections

Written by Iain Thomson

The long-predicted worm which uses a flaw present in all Microsoft operating systems has already spread to Europe.

The Blaster worm, also know as Lovesan, MSBlaster or Poza, attacks via a flaw for which a patch has been available since 16 July.

And, after 15 August, infected computers will be used to launch a denial of service attack against windowsupdate.com, where the patch for the vulnerability can be found.

Infections have already spread in the US and cases started appearing in Europe as the working day started.

"The lion's share of infections are in the US. Now people are waking up we've got infections popping up all over Europe," said David Emm from Network Associates Avert labs.

"We're keeping an eye on it but at present it doesn't look like it's going to be as much of a problem as Slammer. Administrators must still patch their systems as a matter of urgency."

The worm is spread automatically by sending itself via TCP port 135 to random IP addresses, generating large amounts of network traffic.

Once it finds and infects a system it copies itself onto the registry and sets up a shell using TCP port 4444, which downloads a program, msblast.exe, before sending itself out again.

The worm code also contains a message for Microsoft chairman Bill Gates, hidden in the code: "I just want to say LOVE YOU SAN!! billy gates why do you make this possible? Stop making money and fix your software!!"

The worm is particularly worrying since it can be used against both servers and client PCs.

"This puts the future of Windows at threat," said Gary Jones, services manager at MIS Corporate Defence Solutions.

"People underestimate how vicious this exploit code is. A single line of code gives the hacker system-level privileges.

"If someone writes an email worm this is going to spread like wildfire; it affects clients and servers and runs on 90 per cent of the world's PCs."

The critical flaw is in Microsoft's Distributed Component Object Model Remote Procedure Call (RPC) interface.

The vulnerability involves the RPC protocol, which deals with inter-computer communications. Microsoft warned that, under certain circumstances, the RPC might not properly check messages sent to the PC.

The patch is available here, and the major antivirus web sites also have free removal utilities available.

  • Have your say
  • Send to a friend
  • Print this
  • Share

Tags:

reader comments

related articles

New PCs risk Blaster infection

Unpatched versions of XP and 2000 still sitting on high street shelves 02 Oct 2003

 

Viruses 'a blessing in disguise'

Tell that to the IT managers ... 18 Sep 2003

Business giants Blasted by virus

Canon and Sainsbury's forced to shut down systems as worm strikes 21 Aug 2003

Mistake foils Blaster Denial of Service

Worm writer's basic error sends DoS attacks to wrong address 18 Aug 2003

New Blaster worm variants on the loose

Trojan payload for new worm identified by antivirus experts 15 Aug 2003

Sun Mad as a Hatter over Microsoft worm

Registration for open source project brought forward 14 Aug 2003

Microsoft battens down for Blaster attack

Infections falling but denial of service attack due this weekend 13 Aug 2003

related whitepapers

today's top stories

Police hunt for moles with security software

Lancashire Constabulary to monitor data input of 7,000 staff in bid to prevent intelligence leaks 09 Feb 2010

PaperlinX outsources IT and comms to Bull and BT

Paper company spends €22m on five-year deal for desktop management, helpdesk and datacentre services 05 Feb 2010

Social tools take KM to a new level

Technology expert David Tebbutt explains how – and why – organisations should integrate social networking tools into their knowledge management strategy 02 Feb 2010

EDS court defeat puts vendors on their guard

BSkyB’s victory in a long-running court case against EDS has serious implications for the IT industry 02 Feb 2010

Law firm monitors web traffic violations

Bucks declining global security appliance sales with unified threat management (UTM) platform deployment 01 Feb 2010

Advertisement

Security: The New Face of Intrusion Prevention
An outline of traditional IPS functionality, modern developments and how IPS can be deployed easily.

UK businesses’ attitudes to Cloud Computing revealed

Features results from a survey of over 200 Computing readers.

Advertisement

Keep up to date with the latest products, services and technologies from the world's leading IT companies; ITHound.com brings you over 6,000 white papers, case studies and analyst reports.

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

More available - click 'submit' to view

Existing User

Newsletter user login:

Jobs

Related jobs

Job of the week

Job alerts

Sign up here

Find your next job

IT Salary Checker

Check salary here

Advertisement

Latest poll

Internet Explorer 6

Internet Explorer 6

Following recent concerns about the security of Internet Explorer 6 are you planning to phase it out?

View poll results

Latest audio and video articles

Tony McAlisterVideo

Video Q&A: Tony McAlister, CTO, Betfair - Part one

On changing the skills development strategy at the online gambling firm - part one of a two-part video interview 05 Nov 2009

Video

Nokia shows upcoming handset technologies

Mobile phone features of tomorrow take the stage 21 Oct 2009

Latest in-depth articles

Analysis

Police hunt for moles with security software

Lancashire Constabulary to monitor data input of 7,000 staff in bid to prevent intelligence leaks 09 Feb 2010

Businessman with eye patch, dagger and tie round head, sitting at laptopFeatures

Are you sure you're not a pirate?

It is alarmingly easy for an IT leader to unwittingly exceed the scope of a software licence, and the chances of being caught out have never been greater, as technology lawyers Mark Weston and Paul Gershlick explain 09 Feb 2010

Primary Navigation