[Merged] W32/Sasser.worm

FYI;

Advisory
This is a Medium Threat Advisory for W32/Sasser.worm

Justification
W32/Sasser.worm has been deemed Medium due to prevalence

Read About It
Information about W32/Sasser.worm is located on VIL at:
http://vil.nai.com/vil/content/v_125007.htm

Detection
W32/Sasser.worm was first discovered on 30/04/2004 and detection will be added to the 4355 dat files (Release Date: 01/05/2004). The EXTRA.DAT is available.

This exploits a hole covered in the latest MS patch - MS04-011.

[Alan Waddington]

Thanks for the heads up. I've really got to watch the viruses at the moment because someone who has me in their address book has got a NetSky & i keep being gifted with them

Well, Sasser's in my normal virus update i got today from norton, so no need to manually install the extra definitions.

[DrAwesome]

This Link may be useful to someone :0)

[50420]

hi all....apologies if this is being discussed elsewhere...but couldnt find the subject when searched the forums.

just a queery really regarding the sasser alert on the ntl homepage
http://www.ntlworld.com/help/aup/virus_sasser.php

going by the wording of the alert...it sounds as if the relevant ports have been blocked??

more info here on sasser http://securityresponse.symantec.com...er.b.worm.html

only reason i'm askin is cos of a thread on the computeractive forums.....where a poster has accused ntl of crass incompetance and stupidity for informing thier customers that they are not susceptible to sasser. (this aint what is stated in the alert though !!!!) the alert states that MOST ntl cusomers SHOULD not be susceptible to it due to proactive measures.

[MadGamer]

I know M$ have a patch but i can't find it.

[BizBo]

Patch from Microsoft

[jellybaby]

And Here is quite useful too

[philip.j.fry]

And what a pain this virus is, it infected the uni computer system this morning just as I was giving a demonstration of my dissertation project so the computer kept crashing

[Tezcatlipoca]

Originally Posted by 50420

hi all....apologies if this is being discussed elsewhere...but couldnt find the subject when searched the forums.

I've merged your thread with the Sasser thread in the Security forum

just a queery really regarding the sasser alert on the ntl homepage
http://www.ntlworld.com/help/aup/virus_sasser.php

Don't know if NTL have blocked the ports. Maybe one of our NTL-employed members will be able to answer that.

Originally Posted by WNA

I know M$ have a patch but i can't find it.

The patches are in the "Latest Microsoft Patches" announcement in the Computers & Technology forums (at the top of the topics list).

[porpoise]

I got the sassa worm !!! My son wnet onto symantec and downloaded the removal tool for me. I've now got rid of it. I went on to windows update and It said download this update to stay clear of the sassa worm, I checked my history and i'd downloaded it on April 14th !!! Also my son said that I can go into msconfig and get Zonealarm to start earlier in the start up menu ??? how ???

[byron_hinson]

I've noticed CPU Spikes when I am connected to the internet over the last 2 days - any ideas if this is the virus looking for IP Addresses - my machines and clean and all up to date, just can't figure this one out.

[Chris W]

Originally Posted by byron_hinson

I've noticed CPU Spikes when I am connected to the internet over the last 2 days - any ideas if this is the virus looking for IP Addresses - my machines and clean and all up to date, just can't figure this one out.

when you say connecting to the internet, is that using a dial or BB connection? and what exactly do you mean by connecting to the internet? is it opening IE? or any program?

[byron_hinson]

Wireless broadband. Don't have to be running any programs at all for it to show up the problem. if i switch off the wireless connection then everything is fine.

[Chris W]

Just heard that someone has been arrested for the Sasser virus....

not much news yet, just breaking on news24. 18 year old from Germany who wrote and activated that virus on his own.

Good to see that the person responsible has been caught