Blaster
The Blaster Worm (also known as Lovsan, Lovesan or MSBlast) was a computer worm that spread on computers running the Microsoft operating systems Windows XP and Windows 2000, during August 2003. The virus worked like this: once a network (such as a company or university) was infected, it spread faster within the network because firewalls typically did not prevent internal machines from using a certain port. Filtering by ISPs and widespread publicity about the worm curbed the spread of Blaster.
The worm was programmed to start a SYN flood against port 80 of windowsupdate.com if the system date is after August 15 and before December 31st and after the 15th day of other months, thereby creating a DDoS against the site. The damage to Microsoft was minimal as the site targeted was windowsupdate.com, rather than windowsupdate.microsoft.com to which the former was redirected. Microsoft temporarily shut down the targeted site to minimize potential effects from the worm.
The worm's executable, MSBlast.exe, contains two messages. The first reads “I just want to say LOVE YOU SAN!!” This message gave the worm the alternative name of Lovesan. The second reads “billy gates why do you make this possible ? Stop making money and fix your software!!” This is a message to Bill Gates, the co-founder of Microsoft and the target of the worm.
The worm also creates the following registry entry so that it is launched every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ windows auto update=msblast.exe
On August 29, 2003, Jeffrey Lee Parson, an 18-year-old from Hopkins, Minnesota, was arrested for creating the B variant of the Blaster worm; he admitted responsibility and was sentenced to an 18-month prison term in January 2005.
