Sasser Worm Infects Thousands of Computers Worldwide

Bloomberg ^ | May 3, 2004

[FourPeas]

May 3 (Bloomberg) -- A computer worm called Sasser may have infected hundreds of thousands of computers through the Internet and is still spreading, possibly disrupting business today, a security software expert said.

The worm, which is different than a virus because it doesn't need to be attached to an e-mail to spread, causes a computer to shut down and then reboot several times, apparently without causing any permanent damage, said Mikko Hyppoenen, director of virus research with Helsinki-based F-Secure Oyj. The worm was detected Saturday at 4 a.m. Finnish time, he said.

[al_c]

Watch it. As I said, I've been a Mac user for over 15 years.

[brownsfan]

"Watch it. As I said, I've been a Mac user for over 15 years."

Did I forget to mention humorless as well? :P

[general_re]

It's not coming that fast yet - only 30 hits on the firewall in the last 45 minutes from this thing...

[Ole Okie]

I'm proud to say I helped vote this worm out of the Senate.

____________________-
What? You interrupted his concern about the dawficit?

[IamHD]

Norton didn't stop it. I'm trying to get rid of it on my daughter's computer, right now.

[mass55th]

I've been a Mac for about the same length of time and have never had a virus. Not sure what you are picking up.

[ParityErr]

My firewall here at work is registering approx. 3 hits a minute.

[Eva]

My son just called and said that there was something wrong with his computer and he is in the middle of finals and has a paper due. I told him that I would research the problem for him. If you figure out how to fix it, let me know, please.

I just tried to go to Spybot and couldn't get on because they are over loaded.

[general_re]

Using a combination of intelligent routers, carefully located segmenting firewalls, VLANS, and a new forced update system to keep everyone patched up, we're crossing our fingers that this one wont hit us in any significant way.

Block inbound traffic on TCP port 445.

[ParityErr]

Norton won't stop this. If you have a router such as linksys block tcp port 445. This is the door this sucker is coming through.

[dickmc]

Re Panda and Post 4

Switched from Trend Micro Pccillin to Panda about
6 months ago when built new computer (XP home) and found
that I would have to uninstall Zone Alarm in order
to install Pccillin since it had it's own fire wall.
Could have uninstalled Pccillin firewall afterwards
and then reinstalled ZoneAlarm but that looked like
too much risk.

Panda seems faster and seems to work just as well as
TrendMicro's Pccillin. Panda is also cheaper and will
install with a third party firewall like ZoneAlarm already
present. Thus, of the two, Panda and Pccillin, Panda appears
to work as well, if not better, and is also cheaper.
Gave up on Norton years ago after it totally screwed up
a laptop.

[Billthedrill]

Here's some more help.

Symantec/Norton's Info

Trend Micro's Info

[general_re]

Hmmph. I'm getting less than one a minute - so far, it's all from "nearby" machines.

[N. Theknow]

Save your energy. Mac users are zealots. They are insecure that they are out of step with the rest of the world, so they cover it with that elitist attitude. Not surprising that Mac users tend to be liberal! :)

I heard a rumor that MAC users don't fall down.

[Sender]

My neighbor's XP box is down with it. It boots, starts to run, but before she can do anything to help herself, it shuts down.

Her PC was taken down by one of last year's worms as well. At the time, I wasn't having any problems on my XP, so I asked her if she had an antivirus program.

"Oh yeah, we have Norton Antivirus" she told me. However she had refused to pay for a subscription when the time came and her virus file was over a year old. That little error cost her reloading XP, all her apps and losing all the family photos, which she had meant to really put on a CD one of these days.

So now her PC is belly up again, and guess what? She had really meant to pay that $15 for the Norton subscription from last year, and she's trying to pay it NOW, but just can't get it to stay running. And this last year of family photos never got put on a CD either, darn it. It's just not fair!

*sigh*

[IamHD]

"Norton won't stop this."

I know, that's what I said. :) My daughter called me from work this morning and asked me if I could get rid of it. I told her last night to update her patch from MS, but no, moms don't know anything. I'm waiting for her to bring her computer to me. How would you go about blocking port 445?

Also, everytime she tries to get her patch, the computer shuts down. If I startup in safe mode, can I get online and download the patch that way? Or, should I remove the bugger from the registry, first, and then try to patch?

[FourPeas]

Flat learning curve. Perhaps you should remind her to change the oil in her car, too.

[oyez]

bfl just in case

[Billthedrill]

Try THIS TOOL.

Personally, I'd hold out for champagne...

[Snowy]

All of the 'family computer experts' take cover! Unplug your phones! Lock your doors!