What Is Sasser Worm?

Sasser worms are like the cockroaches of the computer world. They're everywhere, and they won't go away. In 2004, a new worm called Sasser was discovered by German researcher Sven Jaschan. It spread quickly through networks because it exploited a vulnerable network port and could easily infect computers running Microsoft OSs such as Windows XP and Windows 2000. Sasser worms were first discovered in April 2004, but they have been around since 1999, when they were first seen in China. They are part of a family of self-executing worms known as W32.Sasser. Sasser comes from the name of its creator, Sven Jaschan (who created it in his spare time). The Sasser bug was written by a German pc technological know-how pupil named Sven Jaschan. The bug was first observed when it exploited a buffer overflow in a technique known as the Local Security Authority Subsystem Service, which enforces a device protection policy. It can unfold to many computer systems very quickly. The Sasser worm uses TCP port number 445 to attack the computer. (Although some Microsoft researchers also say it may use port 139). The worm can spread by sending messages to other computers that share resources with the target machine, such as printers or networked drives. In this way, it can quickly spread from machine to machine through a network of computers connected through their shared resources. The W32.The Sasser worms can also run on Windows 95, 98, and Me computers. The worm may cause LSASS.EXE to crash on some systems, resulting in a reboot. Don't worry. The worm is not known to spread via email attachments, network shares or removable drives. It doesn't try to install itself when it runs; instead, it just tries to take over your computer. The worm is intelligent enough to know what port number your computer uses for SMTP email traffic. It can send itself out as an email message from your machine using your Internet Service Provider's (ISP) SMTP server address and port number as the "From" address. If you think you have been infected with Sasser, we recommend you call us immediately so we can remove it before it can do any damage!