05/18/04 - W32/Sasser.worm.f
This new variant is similar to W32/Sasser.worm.a. It has been repacked using PECompact and is proactively detected as Exploit-DcomRpc using engine 4.3.20 together with DATs 4288 and above. This detection requires the scanning of compressed executables to be enabled
This variant differs from W32/Sasser.worm.a in the filename and registry keys it uses:
Uses the filename napatch.exe (74,752)
This self-executing worm spread by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]
Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.
Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
Symptoms
The virus copies itself to the Windows directory as NAPATCH.EXE and creates a registry run key to load itself at startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "napatch.exe" = %WinDir%\napatch.exe
As the worm scans random IP addresses, it listens on successive TCP ports starting at 1047. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.
A file named winlog2 is created on the root of the C: drive. This file contains an IP address together with the number of machines infected.
Copies of the worm are created in the Windows System directory as #_up.exe.
Examples
C:\WINDOWS\System32\11583_up.exe
C:\WINDOWS\System32\16913_up.exe
C:\WINDOWS\System32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs. The following Window may be displayed:
More info on this worm:
http://vil.nai.com/vil/content/v_125095.htm Removal Instructions
Go to the following website for removal instructions:
http://vil.nai.com/vil/content/v_125095.htm Download Stinger to Scan for infection:
http://vil.nai.com/vil/stinger |
