The Sasser Worm

[theshire]

Anyone experienced this yet? Unlucky if you have.

Basically, for anyone who has no idea what I'm on about, the Sasser Worm is a new computer virus that is sweeping the world. All it does is just cause your system to crash repeatedly, so you have to reboot; and it only works on Windows 2000 or newer. The only way to avoid it is to keep your Firewall up and to make sure you have the latest virus checkers. You have been warned!

And this time, could someone please reply? Don't make me have to start talking to myself again. 😀

 

[Limeoutsider]

Thankfully I still have Windows 98.

 

[tommytikl]

Hey, how the F**K do you get this virus if you don't have to open email to get it?!?!?!

 

[theshire]

It can simply get onto your machine if you have your Web Browser running. Then every time you go onto the Internet after that, you run the risk of passing on to a bunch of other computers. I don't know the technical details of it. I've forgotten what it said on the news.

 

[JPie1]

wouldn't it be nice if all these people creating these viruses did something really good and useful with their brains?? imagine...

 

[P50]

Don't use Microsoft E-mail.

There are other E-mail software packs out there

 

[Limeoutsider]

The newest computer worm has now infected an estimated 1 million computers. The Sasser Worm spreads automatically, not needing the user to open an attachment, causing it to spread very quickly. Home users might notice their computer is infected if their computer mysteriously reboots or their internet connection slows down dramatically. The best defense against this worm is to update their Microsoft patches and install firewalls.

 

[TicklingIsLife]

I say these people making these viruses are in order for a good tickling!

 

[MrMacphisto]

You know... there is a program you can download that deletes the virus from your system. When I got the virus, I just used the program, and I never had any crashes.... The program is called "f-sasser"

 

[TicklingIsLife]

or how about a simple virus scan?
🙄

 

[Limeoutsider]

or how about a simple virus scan?
🙄

Gee, if life were only that simple 🙄 🙄

 

[BOFH666]

Just for the record, if there's anyone reading this that runs Windows XP I'd strongly recommend running Windows Update manually at least once a month. To do this, click on the Start button, go to "All Programs" and look for a "Windows Update" entry, probably at the top of the list. Follow the instructions and make sure to install anything under the Critical Updates and Service Packs menu.

Micorosft traditionaly releases its patches and updates at the start of the month, so I'd suggest paying a visit to Windows Update on either the first or second weekend in any given month. Maybe the second is a better bet as this gives enough time for any problems with a particular patch to be picked up on and fixed.

Steve.

Oh, by the way, would anyone be interested in a "how to secure your computer guide" for the, umm, shall we say, non-technical user?

 

[TicklingIsLife]

Just for the record, if there's anyone reading this that runs Windows XP I'd strongly recommend running Windows Update manually at least once a month. To do this, click on the Start button, go to "All Programs" and look for a "Windows Update" entry, probably at the top of the list. Follow the instructions and make sure to install anything under the Critical Updates and Service Packs menu.

Micorosft traditionaly releases its patches and updates at the start of the month, so I'd suggest paying a visit to Windows Update on either the first or second weekend in any given month. Maybe the second is a better bet as this gives enough time for any problems with a particular patch to be picked up on and fixed.

Thanks for the advice 🙂

 

[Haltickling]

Just for your info: The creator of the "Sasser" worm was arrested today. He is an 18 year old student from Germany.

He'll probably work for a software company after his trial... 🙄

 

[TicklingIsLife]

Just for your info: The creator of the "Sasser" worm was arrested today. He is an 18 year old student from Germany.

He'll probably work for a software company after his trial... 🙄

Where's the justice...

 

[Haltickling]

Oh, he'll get up to 5 years in jail first, and then all the lawsuits for indemnities...

But software companies often hire such hackers to improve their own security. To uncover weak spots, you need to think like a hacker, not like an engineer.

 

[BOFH666]

*Sigh* you know.... I'm not defending this kid but it's a HELL of a tempting target. Think about it, the net offers such a huge degree of anonymity as it is (witness the, umm, cajonies grown by the average usenet user in a flame war) that the results of such a virus are pretty abstracted.

And then there's the fact that Microsoft make things WAY too easy for people to break a Windows system. As part of my day job I've got to try and keep our company a virus-free zone and it's an absolute mission. While every bit of complex software ever written is going to be flawed the basic building blocks of Windows are, well, let's say you don't normally build a house from bricks made of balsa wood.

And I have to say we (meaning the tech community in general) have GOT to get better at helping those who just want to USE their PC rather than be on a first name basis with every circuit board and screw. For example, how many people reading this board go and apply the latest security patches for their machine on a regular basis? How many run virus checkers (and up-to-date virus checkers at that) or firewalls? I suspect that the answer to that question is "the minority" and that's OUR fault. We're meant to be the experts but far, far too often we fail utterly to relate the subject to the user and expect them to come to us. All that leads to is a certain 'mystique' about computers that, now things are a damn sight more user friendly than they were a few years ago, is actually working against all of us with systems left unsecured, unpatched and totally vulnerable to the current virus of the month.

 

[TKpervert]

From the net:

"W32/Sasser-A attempts to connect to computers through ports TCP/9996 and TCP/445. If the Windows computers are not patched against the LSASS vulnerability, an FTP script is downloaded and executed, which connects to port 5554 and downloads a copy of the worm via FTP (File Transfer Protocol).

The worm copies itself to the Windows folder with the filename avserve.exe and sets the following registry key to auto-start on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\avserve = avserve.exe "

If you don't have a firewall, go to zonelabs.com and get their freebie, it's excellent.