Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Sasser Worm Infects Thousands of Computers Worldwide
Bloomberg ^ | May 3, 2004

Posted on 05/03/2004 8:30:21 AM PDT by FourPeas

Edited on 07/19/2004 2:14:00 PM PDT by Jim Robinson. [history]

May 3 (Bloomberg) -- A computer worm called Sasser may have infected hundreds of thousands of computers through the Internet and is still spreading, possibly disrupting business today, a security software expert said.

The worm, which is different than a virus because it doesn't need to be attached to an e-mail to spread, causes a computer to shut down and then reboot several times, apparently without causing any permanent damage, said Mikko Hyppoenen, director of virus research with Helsinki-based F-Secure Oyj. The worm was detected Saturday at 4 a.m. Finnish time, he said.


(Excerpt) Read more at quote.bloomberg.com ...


TOPICS: Business/Economy; Crime/Corruption; Culture/Society; Front Page News; News/Current Events
KEYWORDS: lowqualitycrap; microsoft; sasser; windows; worm
Navigation: use the links below to view more comments.
first previous 1-20 ... 41-6061-8081-100101-116 next last
To: FourPeas
W32.Sasser Removal Tool

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html
61 posted on 05/03/2004 10:16:14 AM PDT by CyberCowboy777 (Veritas vos liberabit)
[ Post Reply | Private Reply | To 1 | View Replies]

To: IamHD
Symantec tools always throws up the warning that you must be an administrator, even if you are an admin on the box.

Run the tool - if you get a error, you will need to login with the default Administrator account (hopefully you know the password!)
62 posted on 05/03/2004 10:21:57 AM PDT by CyberCowboy777 (Veritas vos liberabit)
[ Post Reply | Private Reply | To 49 | View Replies]

To: CyberCowboy777; FourPeas
Cool, thanks! Very interesting. The bottom line is though that running a firewall should stop most of these kind of attacks, right?
63 posted on 05/03/2004 10:23:00 AM PDT by FourtySeven (47)
[ Post Reply | Private Reply | To 58 | View Replies]

To: FourtySeven
My daughter has up to date Norton, and also has zonealarm, and she still got hit with Sasser b. variant. She didn't even have a chance to finish downloading the patch and it shut her computer down. :(
64 posted on 05/03/2004 10:26:26 AM PDT by IamHD
[ Post Reply | Private Reply | To 63 | View Replies]

To: CyberCowboy777
Okey, dokey...Well, the admin has either got to be Gateway, or her. I'll try it before I try to manually delete it. Thanks. I just hate messing with the registry, which I'm going to have to do. I've had to deal with the blaster worm and was able to get rid of that, but I'm just a mom, not a computer genius. :)
65 posted on 05/03/2004 10:32:34 AM PDT by IamHD
[ Post Reply | Private Reply | To 62 | View Replies]

To: FourtySeven
Firewall and up-to-date AntiVirus.

Most folks have no need for FTP and other TCP ports being open, shut them down.

CABLE USERS - Many Broadband companies will sell you a cable modem (SurfBoard is common) and you will be able to get on the Internet. However I highly suggest you purchase a Cable/DSL router and put it in between your Cable Modem and PCs. A Router with a 4 port switch (for 4 PCs) can cost as little as $50.00 and the control and protection it will give you is priceless.

These Routers will have a easy to use Web Interface and a manual for setup. The Firewall functions can usually be set to default High Level Security to block all uninitiated inbound TCP ports.
66 posted on 05/03/2004 10:32:55 AM PDT by CyberCowboy777 (Veritas vos liberabit)
[ Post Reply | Private Reply | To 63 | View Replies]

To: FourtySeven
IF the firewall is properly configured.
67 posted on 05/03/2004 10:34:20 AM PDT by FourPeas
[ Post Reply | Private Reply | To 63 | View Replies]

To: al_c
Don't start that. I have been a Mac user for well over 15 years and I have had my share of viruses. Not many, but enough to be annoyed by them.

More than 20,000 recorded viruses for the wintel environment vs less than 100 for mac... Ill take your annoyance over putting my helpdesk on suicide watch any day?

And now that the Mac uses Unix, they are now even more of a target.

Interesting, do you have anything to back that up with?

68 posted on 05/03/2004 10:35:32 AM PDT by N3WBI3
[ Post Reply | Private Reply | To 17 | View Replies]

To: All
I recently had something get onto my computer that has installed a lot of adware.

I have Spybot Search and Destroy, Norton AV, Ad Aware, and Swat It.

I have run all of them, but something obviously can't be removed since I notice every time I go back into Ad-Aware another huge number of adware files is in there, so the main suspicious program has not been fully removed.

Any advice on what to do?

69 posted on 05/03/2004 10:36:25 AM PDT by rwfromkansas ("Am I not destroying my enemies when I make friends of them?" -- Abraham Lincoln)
[ Post Reply | Private Reply | To 1 | View Replies]

To: IamHD
If you can't get admin privileges manual removal will not work either as the right the tool needs are the same rights you will need - registry control.

Try to get logged in as the "administrator". Whomever installed the O/S should know the password.

If she has been installing software and the like then she likely has some advanced user rights at a minimum.
70 posted on 05/03/2004 10:36:48 AM PDT by CyberCowboy777 (Veritas vos liberabit)
[ Post Reply | Private Reply | To 65 | View Replies]

To: FourPeas
Just for grins, here's the Microsoft link on Sasser
71 posted on 05/03/2004 10:40:00 AM PDT by FourPeas
[ Post Reply | Private Reply | To 1 | View Replies]

To: N3WBI3
More than 20,000 recorded viruses for the wintel environment vs less than 100 for mac...

What a coincidence... That's also roughly the ratio of useful Windows applications to Mac applications, and Windows users to Mac users...

72 posted on 05/03/2004 10:44:48 AM PDT by Ichneumon
[ Post Reply | Private Reply | To 68 | View Replies]

To: al_c
I have been a Mac user for well over 15 years and I have had my share of viruses.

Somehow I cannot believe that. I have only seen one mac virus and it was on someone else's machine 10 years ago.

And now that the Mac uses Unix, they are now even more of a target.

Don't think so. Now they are even more secure.

73 posted on 05/03/2004 10:48:11 AM PDT by zeebee (half is better than none)
[ Post Reply | Private Reply | To 17 | View Replies]

To: brownsfan
Me? Humorless?! ;o)
74 posted on 05/03/2004 10:49:38 AM PDT by al_c
[ Post Reply | Private Reply | To 22 | View Replies]

To: IamHD
From a geek board
(found at http://www.antionline.com/showthread.php?s=b3a2d649823a28b14ebfc67c8f0886ff&threadid=257313):

type: virus, worm
infection length 15,872 bytes
Systems affected - Windows 2000,XP, Windows Server 2003,
Systems not infected - Linux, MAC, Novell Netware, OS2, Unix

W32. Sasser worm is a worm that attempts to exploit ms04-11 vulnerability. It spreads by scanning randomly choosen IP address for vulnerable systems.

Attempts to connect to random generated IP addressess on TCP port 445. If a connection is made to a computer, the worm sends shellcode to that computer which may cause it to run a remote shell on TCP port 9996.

The worm then uses the shell to cause the computer to connect back to the FTP server on port 5554, and retrieve a copy of the worm. This copy will have a name consisiting of 4 or 5 digits followed by _up.exe (example 31337_up.exe)

How to remove it

1. Make sure you connect to the internet with some form of protection like enabling Internet Connection Firewall( ICF).

2. Press control + alt + delete to bring up Windows Task Manager.

3. Click process tab

4. Double click 'image name' to sort the processes.

5. Look through the list and try to find avserve.exe & avserve2.exe or any process with a name consisting of 4 or 5 digits followed by _up.exe

If you find one , click it, and then click end process.

6.Exit the Task manager.

To download the tool instantly and completely remove this nasty worm can be found at http://vil.nai.com/vil/stinger or http://download.nai.com/products/mc...ert/stinger.exe

When done, reboot PC and make sure to visit http://v4.windowsupdate.microsoft.com/en/default.asp

for the latest updates, patches Hope this helps, Computernerd22
75 posted on 05/03/2004 10:50:13 AM PDT by FourPeas
[ Post Reply | Private Reply | To 64 | View Replies]

To: mass55th
I didn't say it was as common as Windows viruses, but the ones for Mac do exist.
76 posted on 05/03/2004 10:50:30 AM PDT by al_c
[ Post Reply | Private Reply | To 26 | View Replies]

To: N3WBI3
More than 20,000 recorded viruses for the wintel environment vs less than 100 for mac... Ill take your annoyance over putting my helpdesk on suicide watch any day?

LOL. Agreed.

Interesting, do you have anything to back that up with?

Unix is more widely used than the old Mac OS, therefore probably more widely targeted.

77 posted on 05/03/2004 10:52:08 AM PDT by al_c
[ Post Reply | Private Reply | To 68 | View Replies]

To: Arthalion
We are doing so from the Internet, but we have more than a thousand outside PC's that connect via RAS or VPN, and they tend to be the weak link in our security.

Ah, there's always a catch, isn't there? ;)

Good luck - sounds like you guys are being solidly proactive, but I'll cross my fingers for ya just in case..

78 posted on 05/03/2004 10:52:51 AM PDT by general_re (Drive offensively - the life you save may be your own.)
[ Post Reply | Private Reply | To 51 | View Replies]

To: Arthalion
outside PC's that connect via RAS or VPN

That sounds familiar: Crackdown.

79 posted on 05/03/2004 10:57:14 AM PDT by FourPeas
[ Post Reply | Private Reply | To 51 | View Replies]

To: Snowy
Yeah I hear ya, I spent a beautiful Sunday morning in Houston playing phone support to my Dad. He at least called Microsoft to get some help, but when it looked like he would be on hold for 4 hours, he called me. Had him cleaned up in 30 minutes.
80 posted on 05/03/2004 11:02:56 AM PDT by OC_Steve (Dudes, how Y'all doin?)
[ Post Reply | Private Reply | To 40 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-20 ... 41-6061-8081-100101-116 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson