Avatar de Usuario
msc hotline sat
Mensajes: 93652
Registrado: 09 Mar 2004, 20:39


Mensaje por msc hotline sat » 10 May 2004, 10:13

Una bueva variante del virus de moda, W32/SASSER ha sido detectada en Internet, aunque su propagacion es todavía inicial, y solo se controla con SDATDAILY hasta que em miercoles tarde aparezcan los DAT 4359, salvo que su propagacion haga adelantar la fecha de presentacion de dichos DATS.

La descripcion, segun McAfee:


Virus Name Risk Assessment

W32/Sasser.worm.e Corporate User : Low

Home User : Low

Virus Information

Discovery Date: 05/08/2004

Origin: Unknown

Length: 15,872 byte

Type: Virus

SubType: Internet Worm

Minimum DAT: 4359 (05/12/2004)

Updated DAT: 4359 (05/12/2004)

Minimum Engine: 4.2.40

Description Added: 05/08/2004

Description Modified: 05/08/2004 7:44 PM (PT)

Description Menu

Virus Characteristics


Method Of Infection

Removal Instructions

Variants / Aliases

Rate This page

Print This Page

Email This Page


Virus Characteristics:

This Sasser variant is similar to W32/Sasser.worm.d , with the following exceptions:

This variant uses the filename lsasss.exe (15,872)

NOTE: This filename was chosen to confuse people. There is a valid file named lsass.exe

It creates a remote shell on TCP port 1022 rather than 9995

It uses the file c:\ftplog.txt rather than c:\win2.log

It uses FTP on TCP port 1023 instead of 5554

It attempts to disable Bagle variants by removing registry keys created by Bagle

This self-executing worm spread by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]

Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.

Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:

Top of Page


The virus copies itself to the Windows directory as LSASSS.EXE and creates a registry run key to load itself at startup


CurrentVersion\Run "lsasss.exe" = %WinDir%\lsasss.exe

The virus attempts to remove the following registry keys, used by various Bagle virus variants:


CurrentVersion\Run "ssgrate.exe"


CurrentVersion\Run "drvsys.exe"


CurrentVersion\Run "Drvddll_exe"

As the worm scans random IP addresses, it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 1023, and creates a remote shell on TCP port 1022.

A file named ftplog.txt is created on the root of the C: drive. This file contains an IP address together with the number of machines infected.

Copies of the worm are created in the Windows System directory as #_up.exe. (Where '#' represents a string 4 or 5 digits.)




A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs. The following Window may be displayed:

Top of Page

Method Of Infection

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

The propagation mechanism is akin to that for previous variants:

the worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.

It creates a remote shell on TCP port 1023.

Next it creates an FTP script named cmd.ftp on the remote host and executes it. Via the FTP script, the FTP.EXE application is used to retrieve the worm from the infected machine (port 1023) to the remote host. The worm is then executed.

the FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as mentioned above) from the infected host.

The infected host accepts this FTP traffic on TCP port 1023.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The worm scans public ranges like and only if they are part of the local subnet. The destination port is TCP 445.


Para su eliminacion ya se ha subido una nueva versión 1.3 del ELISASSA.EXE, que pasa a controlar y eliminar dicha nueva variante, además de las anteriores:


ms, 10-05-2004


Volver a “ALERTAS VIRICAS y utilidades de eliminacion”