Discussion in 'malware problems & news' started by Marianna, May 9, 2004.

Thread Status:
Not open for further replies.
  1. Marianna

    Marianna Spyware Fighter

    Apr 23, 2002
    B.C. Canada
    Virus Information
    Discovery Date: 05/08/2004
    Origin: Unknown
    Length: 15,872 byte
    Type: Virus
    SubType: Internet Worm

    This Sasser variant is similar to W32/Sasser.worm.d , with the following exceptions:

    This variant uses the filename lsasss.exe (15,872)
    NOTE: This filename was chosen to confuse people. There is a valid file named lsass.exe
    It creates a remote shell on TCP port 1022 rather than 9995
    It uses the file c:\ftplog.txt rather than c:\win2.log
    It uses FTP on TCP port 1023 instead of 5554
    It attempts to disable Bagle variants by removing registry keys created by Bagle
    This self-executing worm spread by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]

    Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.

    Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:


    The virus copies itself to the Windows directory as LSASSS.EXE and creates a registry run key to load itself at startup

    CurrentVersion\Run "lsasss.exe" = %WinDir%\lsasss.exe
    The virus attempts to remove the following registry keys, used by various Bagle virus variants:

    CurrentVersion\Run "ssgrate.exe"
    CurrentVersion\Run "drvsys.exe"
    CurrentVersion\Run "Drvddll_exe"
    As the worm scans random IP addresses, it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 1023, and creates a remote shell on TCP port 1022.

    A file named ftplog.txt is created on the root of the C: drive. This file contains an IP address together with the number of machines infected.

    Copies of the worm are created in the Windows System directory as #_up.exe. (Where '#' represents a string 4 or 5 digits.)


    A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs. The following Window may be displayed:

    More: http://vil.nai.com/vil/content/v_125091.htm
Thread Status:
Not open for further replies.