Re: How is Blaster caught?

From: Tim H. (tekphobia_at_comcast.net)
Date: 08/14/03


Date: Thu, 14 Aug 2003 17:23:15 GMT


"Martin C.E." <martin_2003@mail.com> wrote in message
news:93D7B98B2AAFF835A@130.133.1.4...
> How is the Blaster worm caught?
>
> I looked at http://vil.nai.com/vil/content/v_100547.htm
> but I was no wiser.
>
> A worm to me is something which propagates by email. But some tech
> support guy I spoke to said that Blaster propagated just by the user
> visiting a web page.

I hope he wasn't Tech. Support for a major anti-virus company!

As someone else said, it catches you. If your system is unpatched, another
PC on the network infected with the virus will scan random IP addresses
looking for its next victim. If your system happens to be unpatched and
response to DCOM RPC requests, it'll send its packet to effictively change
the operation of DCOM RPC to server another function: listen for remote
connections.

When this remote connection comes in, it essentially commands your PC to
download and run a file. From there it continues (scanning, infecting,
executing).

-TIm

>
> Can anyone advise me on the true way Blaster is caught.



Relevant Pages

  • How is Blaster caught?
    ... How is the Blaster worm caught? ... but I was no wiser. ... A worm to me is something which propagates by email. ...
    (comp.security.misc)
  • Re: How is Blaster caught?
    ... > How is the Blaster worm caught? ... > A worm to me is something which propagates by email. ... But some tech ...
    (comp.security.misc)
  • RE: many run in to blaster worm 32 "same""
    ... security update or the 824146 security update installed.). ... During the installation of KB833330.exe, Setup verifies that one of these ... 833330 A tool is available to remove Blaster worm and Nachi worm infections ... Blaster Worm FAQ: ...
    (microsoft.public.security.virus)
  • Re: Windows keeps shutting down automatically while getting online
    ... you have got the blaster virus or a variant. ... 833330 A tool is available to remove Blaster worm and Nachi worm ... Blaster Worm Security Bulletin: ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: blaster
    ... NEW BLASTER REMOVAL TOOL: ... 833330 A tool is available to remove Blaster worm and Nachi worm infections ... Windows 2000 Security Homepage: ...
    (microsoft.public.security.virus)