Media releases are provided as is by companies and have not been edited or checked for accuracy. Any queries should be directed to the company itself.

Trend Micro: MSBLAST.D infections primarily in US and Asia

  • 19 August, 2003 15:09

<p>Leading antivirus and content security company, Trend Micro has reported infections of the new Microsoft Blaster, WORM_MSBLAST.D variant (aliases W32/Nachi, Welchia and Blaster.D) have occurred primarily in the United States, China and Singapore.</p>
<p>As of 12:00pm (EST) on Tuesday 19th August Trend Micro has received 430 customer calls globally. MSBLAST.A prompted more than 500 calls globally, and while Trend Micro users have fared better than most, MSBLAST.A is still the 5th fastest spreading worm in Australia according to Trend Micro’s Worldwide Tracking System.</p>
<p>The MSBLAST.D variant was first detected in Asia on Monday night. TrendLabs has received scattered infection reports from Japan, Taiwan, and Singapore.</p>
<p>Mr Joel Montgomery, Trend Micro’s Product Marketing Manager said, the new worm variant attempts to delete the original worm (WORM_MSBLAST.A, a/k/a Blaster, Lovsan) from infected systems and install Microsoft patches to repair the underlying vulnerability that enables both worms to spread.</p>
<p>“We recommend customers adopt an approach encompassing more than just a technology-based response. People, processes and technology need to work in concert to deal with an evolving threat. Dealing with a variant such as MSBLAST.D should require little effort if the outbreak lifecycle process was dealt with effectively when the A variant hit. It exploits the same vulnerability and triggers the same internal response mechanisms,” Mr Montgomery said.</p>
<p>The original MSBlast worm infected hundreds of thousands of computers beginning August 11, and attempted to launch a distributed denial of service attack on Microsoft’s Windows Update Web site on August 16th. However, the worm targeted an incorrect address (http:\\ from which Microsoft normally redirected traffic to the service’s correct Web page (</p>
<p>Trend Micro customers remained relatively unaffected by MSBLAST.A due primarily to the quick dispatch of the Outbreak Prevention Policy which allowed Trend Micro to shut down customers ports dynamically (e.g. Port 4444) to prevent the spread of the infection.</p>
<p>MSBlast.D usually arrives as a file named DLLHOST.EXE, approximately 10,240 bytes in size. (A Windows system file with the same name is only 6 kilobytes in size.) Like the original worm, the variant spreads solely through Internet and LAN traffic by scanning for new hosts.</p>
<p>MSBLAST.A exploits the RPC DCOM buffer overflow security flaw in Windows NT, 2000 and XP, instructing target systems to download a copy of itself from the infected system via TCP Port 707, using a TFTP server program. MSBlast.D also uses a WebDAV exploit to penetrate vulnerable systems, which again enables it to arrange for the downloading of worm code via Port 707 and the TFTP server. The RPC DCOM and WebDAV vulnerabilities were disclosed by Microsoft in July and March 2003, respectively.</p>
<p>TrendLabs’ analysis shows that the worm proceeds to terminate and delete the MSBLAST.EXE file, which is infected by MSBlast.A, on Windows 2000 and XP systems. It next downloads patches to repair the RPC DCOM buffer overflow in Chinese, English and Korean, installing those that match the language on the infected machine, and rebooting the system. (Users of other language versions of Windows go unpatched.)</p>
<p>MSBlast.D will then remain on the system and continue to search for new hosts throughout 2003. When the malware finds that the year is 2004, it automatically eliminates itself from the system by removing the services it had created and deleting itself.</p>
<p>The RPC DCOM vulnerability can allow intruders full access and the ability to execute any code on target machines, leaving them seriously compromised. It affects recent versions of the Windows operating system: Windows.</p>
<p>The pattern file, Outbreak Prevention Policy and System Cleaner are all available to Trend Micro customers now.</p>
<p>Non Trend Micro users with Internet connections can use HouseCall, Trend Micro's free online virus scanner, at The Trend Micro Virus Map displays information about worldwide virus trends based on actual virus infections detected by Trend Micro</p>
<p>About Trend Micro</p>
<p>Trend Micro is the world leader in providing centrally controlled server-based virus protection and content-filtering products and services. By protecting information that flows through Internet gateways, email servers and file servers, Trend Micro allows companies and service providers worldwide to stop viruses and other malicious code from a central point before they enter the network. Trend Micro was recently acknowledged as the worldwide leader in server-based antivirus in the IDC report "Antivirus Software 2002: A segmentation of the market". For more information visit

Most Popular

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

Logitech Ultimate Ears Wonderboom Bluetooth Speaker

Learn more >

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Latest Articles


PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?