W32/Sasser.C Worm

 Information about the W32/Sasser.C worm:

W32/Sasser.C is a worm. This worm is a variant of W32/Sasser. The worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits LSASS vulnerability present in Windows as explained by Microsoft Security Bulletin MS04-011.

Upon execution of the worm, it modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm opens ftp port 5554 and randomly scans for the computers with this flaw on the network. If found then the worm creates a remote access through TCP 9996 then downloads the file avserve2.exe to Windows folder. The worm tries to copy itself to Windows System folder as <variable string>_up.exe. The worm keeps the ip address of the localhost in win2.log under root of C: drive.

Microsoft has released a patch for this MS04-011 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 2nd May 2004.

 Other names of W32/Sasser.C:

This worm is also known as W32/Sasser.worm.c , W32/Sasser-C, WORM_SASSER.C