Feeds

Blaster worm variants make mischief

Copycat bugs

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Anti-virus firms are warning of the appearance of fresh variants of the Blaster worm, the first version of which created chaos by crashing numerous vulnerable Windows machines earlier this week.

Two new variants of Blaster (AKA Lovesan), first spotted yesterday, are both minor variations on the original worm. The two variants are called Blaster-B and (surprise, surprise) Blaster-C.

According to an analysis by Kaspersky Labs on Blaster-C, slight changes have been applied to the appearance of the worm such as a new name of the main worm-carrier file (TEEKIDS.EXE instead of MSBLAST.EXE), a new method of the code compression (FSG instead of UPX), and new "copyright" strings in the body of the worm abusing Microsoft and anti-virus developers. Similar types of changes have been applied to Blaster-B (eg. PENIS32.EXE instead of MSBLAST.EXE etc.)

The worm code essentially remains the same in the copycats as in the original. For this reason most AV scanners will spot the new variants without additional updates.

Vincent Weafer, Senior Director at Symantec Security Response Centre, said it seeing very little extra activity as a result of either Blaster-B or Blaster-C, which he described as "very minor 'renamed and repacked' variants" of the original Blaster worm. However he urged caution because additional variants of the worm, some of which may prove to be even more potent than the original worm, can be expected. ®

Related Stories

Blaster worm spreading rapidly
Panel probes the half-life of bugs
Microsoft issues doubleplus critical security fix
The Hackers Who Broke Windows

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.