Posteriormente han aparecido las variantes B y C que se controlan con los DATS 4356, ya disponibles:
Todos ellos, uno tras otro, está descritos en la siguiente informacion de McAfee:
Como se puede ver por la siguiente informacion, entra por el agujero MS04-011 el cual debe parchearse conectando con
__________________________________________
Virus Name Risk Assessment
W32/Sasser.worm.a Corporate User : Medium
Home User : Medium
Virus Information
Discovery Date: 04/30/2004
Origin: Unknown
Length: 15,872 bytes
Type: Virus
SubType: Internet Worm
Minimum DAT: 4355 (05/01/2004)
Updated DAT: 4356 (05/02/2004)
Minimum Engine: 4.2.40
Description Added: 04/30/2004
Description Modified: 05/02/2004 9:19 PM (PT)
Description Menu
Virus Characteristics
Symptoms
Method Of Infection
Removal Instructions
Variants / Aliases
Rate This page
Print This Page
Email This Page
Legend
Virus Characteristics:
-- Update May 1st, 2004 --
The assessment of this threat has been upgraded to Medium due to an increase in prevalence
If you think that you may be infected with this threat, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present.
Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]
The worm spreads with the file name: avserve.exe . Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.
Top of Page
Symptoms
The virus copies itself to the Windows directory as avserve.exe and creates a registry run key to load itself at startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve.exe" = C:\WINDOWS\avserve.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.
A file named win.log is created on the root of the C: drive. This file contains the IP address of the localhost.
Copies of the worm are created in the Windows System directory as #_up.exe.
Examples
c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs. The following Window may be displayed:
Top of Page
Method Of Infection
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host accepts this FTP traffic on TCP port 5554.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445
Top of Page
Removal Instructions
All Users :
Use the specified DAT files for detection and removal.
Alternatively, the following EXTRA.DAT packages are available.
EXTRA.DAT
SUPER EXTRA.DAT
Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
Additional Windows ME/XP removal considerations
Stinger
Stinger has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode
Top of Page
Variants
Name Type Sub Type Differences
Top of Page
Aliases
Name
W32.Sasser.Worm (Symantec)
W32/Sasser.A (F-Secure)
W32/Sasser.worm
Virus Name Risk Assessment
W32/Sasser.worm.b Corporate User : Medium
Home User : Medium
Virus Information
Discovery Date: 05/01/2004
Origin: Unknown
Length: 15,872 bytes
Type: Virus
SubType: Internet Worm
Minimum DAT: 4356 (05/02/2004)
Updated DAT: 4356 (05/02/2004)
Minimum Engine: 4.2.40
Description Added: 05/01/2004
Description Modified: 05/02/2004 8:21 PM (PT)
Description Menu
Virus Characteristics
Symptoms
Method Of Infection
Removal Instructions
Variants / Aliases
Rate This page
Print This Page
Email This Page
Legend
Virus Characteristics:
-- Update May 02, 2004 --
This risk assessment of this threat was upgraded to Medium due to an increase in prevalence.
If you think that you may be infected with this threat, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present.
Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]
The worm spreads with the file name: avserve2.exe . Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.
Top of Page
Symptoms
The virus copies itself to the Windows directory as avserve2.exe and creates a registry run key to load itself at startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve2.exe" = C:\WINDOWS\avserve2.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.
A file named win2.log is created on the root of the C: drive. This file contains an IP address.
Copies of the worm are created in the Windows System directory as #_up.exe.
Examples
c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs. The following Window may be displayed:
Top of Page
Method Of Infection
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host accepts this FTP traffic on TCP port 5554.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445
Top of Page
Removal Instructions
All Users :
Use the specified DAT files for detection and removal.
Alternatively, the following EXTRA.DAT packages are available.
EXTRA.DAT
SUPER EXTRA.DAT
Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
Additional Windows ME/XP removal considerations
Stinger
Stinger has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE2.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve2" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode
Top of Page
Variants
Name Type Sub Type Differences
Top of Page
Aliases
Name
W32/Sasser.b.worm
Virus Name Risk Assessment
W32/Sasser.worm.c Corporate User : Low
Home User : Low
Virus Information
Discovery Date: 05/02/2004
Origin: Unknown
Length: 15,872 bytes
Type: Virus
SubType: Internet Worm
Minimum DAT: 4356 (05/02/2004)
Updated DAT: 4356 (05/02/2004)
Minimum Engine: 4.2.40
Description Added: 05/02/2004
Description Modified: 05/02/2004 8:20 PM (PT)
Description Menu
Virus Characteristics
Symptoms
Method Of Infection
Removal Instructions
Variants / Aliases
Rate This page
Print This Page
Email This Page
Legend
Virus Characteristics:
If you think that you may be infected with this threat, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present.
Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]
The worm spreads with the file name: avserve2.exe . Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.
Top of Page
Symptoms
The virus copies itself to the Windows directory as avserve2.exe and creates a registry run key to load itself at startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve2.exe" = C:\WINDOWS\avserve2.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.
A file named win2.log is created on the root of the C: drive. This file contains an IP address.
Copies of the worm are created in the Windows System directory as #_up.exe.
Examples
c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs. The following Window may be displayed:
Top of Page
Method Of Infection
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host accepts this FTP traffic on TCP port 5554.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445
Top of Page
Removal Instructions
All Users :
Use the specified DAT files for detection and removal.
Alternatively, the following EXTRA.DAT packages are available.
EXTRA.DAT
SUPER EXTRA.DAT
Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
Additional Windows ME/XP removal considerations
Stinger
Stinger has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE2.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve2" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode
__________________________________________
Hemos hecho la utilidad ELISASSA.EXE que detectará si se tiene instalado dicho parche e informará al respecto si no lo encuentra, para que se instale tan pronto se pueda, y aceptando luego mira si está el virus y si lo encuentra, detiene el proceso, restaura las claves y elimina el gusano.
saludos
ms, 03-05-2004
msc hotline sat Virus Research Engineer