Nova epidemija - zakrpite Windows
Worm.Win32.Sasser u dvije varijante, za dva dana
Worm.Win32.Sasser.a
[ 05/02/2004 21:54, GMT +03:00, Moscow ]
Danger : moderate risk
This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service. The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
http://www.microsoft.com/technet/sec.../MS04-011.mspx
The worm is written in C/C++ using Visual C compiler. It is approximately 15KB in size, and packed using ZiPack.
Propagation
When launching, the worm registers itself in the system registry autorun key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
avserve.exe = %WINDIR%\avserve.exe
The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011. A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.
Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself. The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.
Worm.Win32.Sasser.b
[ 05/02/2004 22:14, GMT +03:00, Moscow ]
Danger : moderate risk
This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service. The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
http://www.microsoft.com/technet/sec.../MS04-011.mspx
The worm is written in C/C++ using Visual C compiler. It is approximately 15KB in size, and packed using ZiPack.
Propagation
When launching, the worm registers itself in the system registry autorun key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
avserve2.exe = %WINDIR%\avserve2.exe
The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011. A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.
Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself. The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.
