When W32.Sasser.Worm runs, it does the
following:
- Attempts to create a mutex called Jobaka3l and
exits if the attempt fails. This ensures that no
more than one instance of the worm can run on the
computer at any time.
- Copies itself as %Windir%\avserve.exe.
Note: %Windir% is a variable. The worm
locates the Windows installation folder (by default,
this is C:\Windows or C:\Winnt) and copies itself to
that location.
- Adds the
value:
"avserve.exe"="%Windir%\avserve.exe"
to
the registry
key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so
that the worm runs when you start Windows.
- Uses the AbortSystemShutdown API to hinder
attempts to shut down or restart the
computer.
- Starts an FTP server on TCP port 5554. This
server is used to spread the worm to other
hosts.
- Attempts to connect to randomly-generated IP
addresses on TCP port 445. If a connection is made
to a computer, the worm sends shellcode to that
computer which may cause it to run a remote shell on
TCP port 9996. The worm then uses the shell to cause
the computer to connect back to the FTP server on
port 5554 and retrieve a copy of the worm. This copy
will have a name consisting of 4 or 5 digits
followed by _up.exe (eg 74354_up.exe).
The IP
addresses generated by the worm are distributed as
follows:
- 50% are completely random
- 25% have the same first octet as the IP
address of the infected host
- 25% have the same first and second octet as
the IP address of the infected
host.
The worm starts 128 threads that scan
randomly-chosen IP addresses. This demands a lot of
CPU time and as a result an infected computer may be
so slow as to be barely useable.
Symantec Security Response encourages all users and
administrators to adhere to the following basic security
"best practices":
- Turn off and remove unneeded services. By default,
many operating systems install auxiliary services that
are not critical, such as an FTP server, telnet, and a
Web server. These services are avenues of attack. If
they are removed, blended threats have less avenues of
attack and you have fewer services to maintain through
patch updates.
- If a blended
threat exploits one or more network services,
disable, or block access to, those services until a
patch is applied.
- Always keep your patch levels up-to-date,
especially on computers that host public services and
are accessible through the firewall, such as HTTP,
FTP, mail, and DNS services.
- Enforce a password policy. Complex passwords make
it difficult to crack password files on compromised
computers. This helps to prevent or limit damage when
a computer is compromised.
- Configure your email server to block or remove
email that contains file attachments that are commonly
used to spread viruses, such as .vbs, .bat, .exe, .pif
and .scr files.
- Isolate infected computers quickly to prevent
further compromising your organization. Perform a
forensic analysis and restore the computers using
trusted media.
- Train employees not to open attachments unless
they are expecting them. Also, do not execute software
that is downloaded from the Internet unless it has
been scanned for viruses. Simply visiting a
compromised Web site can cause infection if certain
browser vulnerabilities are not patched.
Removal using the W32.Sasser
Removal Tool
Symantec Security Response has
developed a removal
tool to clean the infections of W32.Sasser.Worm.
This is the easiest way to remove this threat and should
be tried first.
Manual Removal
The
following instructions pertain to all current and recent
Symantec antivirus products, including the Symantec
AntiVirus and Norton AntiVirus product lines.
- End the malicious process.
- Disable System Restore (Windows Me/XP).
- Update the virus definitions.
- Run a full system scan and delete all the files
detected as W32.Sasser.Worm.
- Reverse the change made to the
registry.
For details on each of these
steps, read the following instructions.
1. To
end the malicious process
To end the malicious process:
- Press Ctrl+Alt+Delete once.
- Click Task Manager.
- Click the Processes tab.
- Double-click the Image Name column header to
alphabetically sort the processes.
- Scroll through the list and look for the
following processes:
- avserve.exe
- any process with a name consisting of 4 or 5
digits followed by _up.exe (eg
74354_up.exe).
- If you find any such process, click it, and then
click End Process.
- Exit the Task Manager.
2. To
disable System Restore (Windows Me/XP)
If you are
running Windows Me or Windows XP, we recommend that you
temporarily turn off System Restore. Windows Me/XP uses
this feature, which is enabled by default, to restore
the files on your computer in case they become damaged.
If a virus, worm, or Trojan infects a computer, System
Restore may back up the virus, worm, or Trojan on the
computer.
Windows prevents outside programs,
including antivirus programs, from modifying System
Restore. Therefore, antivirus programs or tools cannot
remove threats in the System Restore folder. As a
result, System Restore has the potential of restoring an
infected file on your computer, even after you have
cleaned the infected files from all the other
locations.
Also, a virus scan may detect a threat
in the System Restore folder even though you have
removed the threat.
For instructions on how to
turn off System Restore, read your Windows
documentation, or one of the following articles:
Note: When you are completely finished with the
removal procedure and are satisfied that the threat has
been removed, re-enable System Restore by following the
instructions in the aforementioned documents.
For additional information, and an alternative to
disabling Windows Me System Restore, see the Microsoft
Knowledge Base article, "Antivirus
Tools Cannot Clean Infected Files in the _Restore
Folder," Article ID:
Q263455.
3. To update the virus definitions
Symantec
Security Response fully tests all the virus definitions
for quality assurance before they are posted to our
servers. There are two ways to obtain the most recent
virus definitions:
- Running LiveUpdate, which is the easiest way to
obtain virus definitions: These virus definitions are
posted to the LiveUpdate servers once each week
(usually on Wednesdays), unless there is a major virus
outbreak. To determine whether definitions for this
threat are available by LiveUpdate, refer to the Virus
Definitions (LiveUpdate).
- Downloading the definitions using the Intelligent
Updater: The Intelligent Updater virus definitions are
posted on U.S. business days (Monday through Friday).
You should download the definitions from the Symantec
Security Response Web site and manually install them.
To determine whether definitions for this threat are
available by the Intelligent Updater, refer to the Virus
Definitions (Intelligent Updater).
The Intelligent
Updater virus definitions are available:
Read "How
to update virus definition files using the Intelligent
Updater" for detailed
instructions.
4. To scan for and delete
the infected files
- Start your Symantec antivirus program and make
sure that it is configured to scan all the files.
- Run a full system scan.
- If any files are detected as infected with
W32.Sasser.Worm, click Delete.
5. To
reverse the change made to the
registry
WARNING:
Symantec strongly recommends that you back up the
registry before making any changes to it. Incorrect
changes to the registry can result in permanent data
loss or corrupted files. Modify the specified keys only.
Read the document, "
