The mass media recently warn all Internet users a new worm,W32.Sasser.Worm, is widely spread. Unlike other worms infected by emails or email attachments, the Sasser attacks computers through broadband connections between millions of computers worldwide. According to the NAI, "this self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]"

The worm spreads with the file name: avserve.exe . Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.

The virus copies itself to the Windows directory as avserve.exe and creates a registry run key to load itself at startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve.exe" = C:\WINDOWS\avserve.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.

A file named win.log is created on the root of the C: drive. This file contains the IP address of the localhost.

Copies of the worm are created in the Windows System directory as #_up.exe.

Examples

c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs. The following Window may be displayed:



This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx 


Please update your virusscan defintions if you've installed one, or use NAI's McAfee AVERT Stinger to detect and remove the virus:
http://vil.nai.com/vil/stinger/

You can also try one of the following antivirus software vendors' web sites:

Computer Associates:
http://www3.ca.com/threatinfo/virusinfo/virus.aspx?id=39012

F-secure:
http://www.f-secure.com/v-descs/sasser.shtml

Network Associates:
http://vil.nai.com/vil/content/v_125007.htm

Norman:
http://www.norman.com/Virus/Virus_descriptions/14919/en-us?show=default

Panda:
http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?IdVirus=46865&sind=0

Sophos:
http://www.sophos.com/virusinfo/articles/sasser.html

Symantec:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html

Trend Micro:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A