Инфа из symantec.com:
When
W32.Blaster.Worm is executed, it does the following:
Там идёт много фигни разной, далее
Some fixed characteristics of the TCP and IP headers are:
IP identification = 256
...
Source IP address = a.b.x.y, where a.b are from the host ip and x.y are random. In some cases, a.b are random.
Destination IP address = dns resolution of "windowsupdate.com"
TCP Source port is between 1000 and 1999
TCP Destination port = 80
TCP Sequence number always has the two low bytes set to 0; the 2 high bytes are random.
Интересно всё-таки, чё ж это он мелкософту постукивает...
