MS Blaster Worm (msblast.exe) Infection Detection

Critical Nessus Plugin ID 11818


The remote host is infected by a virus.


The remote host seems to be infected by the MS Blaster worm, or the Nachi worm, which may make this host attack random hosts on the internet.


Refer to the vendor advisory.

See Also

Plugin Details

Severity: Critical

ID: 11818

File Name: smb_msblast.nasl

Version: $Revision: 1.26 $

Type: local

Agent: windows

Family: Windows

Published: 2003/08/11

Modified: 2017/08/30

Dependencies: 10400, 10150, 10394

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: SMB/name, SMB/login, SMB/password, SMB/registry_access

Reference Information

MSKB: 824146

MSFT: MS03-039