Virus Profile: W32/Sasser.worm.b

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low-Profiled | Corporate Low-Profiled
Date Discovered: 5/1/2004
Date Added: 5/1/2004
Origin: Unknown
Length: 15,872 bytes
Type: Virus
Subtype: Internet Worm
DAT Required: 4356
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

The virus copies itself to the Windows directory as avserve2.exe and creates a registry run key to load itself at startup

  •  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Run "avserve2.exe" = C:\WINDOWS\avserve2.exe

As the worm scans random ip addresses it listens on successive TCP ports starting at 1068.  It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.

A file named win2.log is created on the root of the C: drive.  This file contains an IP address.

Copies of the worm are created in the Windows System directory as #_up.exe.

Examples

  • c:\WINDOWS\system32\11583_up.exe
  • c:\WINDOWS\system32\16913_up.exe
  • c:\WINDOWS\system32\29739_up.exe

A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs.  The following Window may be displayed:

Methods of Infection

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

This worm scans random IP addresses for exploitable systems.  When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.  It creates a remote shell on TCP port 9996.  Next it creates an FTP script named cmd.ftp on the remote host and executes it.  This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host.  The infected host accepts this FTP traffic on TCP port 5554.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets.  The destination port is TCP 445

Aliases

W32/Sasser.b.worm
   

Virus Characteristics

-- Update June 7, 2004 --
 The assessment of this threat has been downgraded to Low-Profiled due to a decrease in prevalence.

-- Update May 2, 2004 --
 This risk assessment of this threat was upgraded to Medium due to an increase in prevalence.

If you think that you may be infected with this threat, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present. 

Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]

The worm spreads with the file name: avserve2.exe .  Unlike many recent worms, this virus does not spread via email.  No user intervention is required to become infected or propagate the virus further.  The worm works by instructing vulnerable systems to download and execute the viral code.

   

All Users :
 Use the specified DAT files for detection and removal.

Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

If the system reboots before you are able to download and install the patch, the shutdown utility can abort a shutdown that is in progress (counting down).  This utility is part of Windows XP.

  1. Click START, RUN
  2. Type SHUTDOWN -A and hit ENTER

Additional Windows ME/XP removal considerations

Stinger
 Stinger  has been updated to assist in detecting and repairing this threat.

Manual Removal Instructions
To remove this virus "by hand", follow these steps:

  1. Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
  2. Delete the file AVSERVE2.EXE  from your WINDOWS directory (typically c:\windows or c:\winnt)
  3. Edit the registry
    • Delete the "avserve2" value from
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
        Windows\CurrentVersion\Run
  4. Reboot the system into Default Mode

Sniffer Customers
Filters have been developed that will look for Sasser traffic [Sniffer Distributed 4.1/4.2/4.3, Sniffer Portable 4.7/4.7.5, and Netasyst].

McAfee Intrushield
 This worm is detected in all Intrushield signauture sets 1.5.37.5, 1.8.27.2, 1.9.8.2 and later.  In the IntruShield Alert Viewer, you would see the following alert when Sasser worm propagation is detected:

  • DCERPC: Microsoft Windows LSASS Buffer Overflow (0x47601c00)

Customers with in-line deployment should configure the sensor response of the above signature action to block in the policies.

McAfee System Compliance Profiler
 Create a rule to match a registry key

  • Select HKEY_LOCAL_MACHINE from the drop-down box
  • In the field after the drop-down box, enter in the path Software\Microsoft\Windows\CurrentVersion\Run
  • For Value name, enter avserve2.exe
  • In the next drop-down box, select "Registry value does not exist"

McAfee Desktop Firewall
 To prevent possibly remote access McAfee Desktop Firewall users can block incoming TCP port(s) 5554, 9996

McAfee Threatscan
 ThreatScan signatures that can detect the W32/Sasser.worm.b virus are available from:

ThreatScan Signature version: 2004-05-03

ThreatScan users can detect the virus by running a ThreatScan task using the following settings:

  • Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
    -or-
  • Select the "Other" category and "Scan All Vulnerabilities" template.

For additional information:

  • Run the "ThreatScan Template Report"
  • Look for module number #4073

ThreatScan users can detect the remote access component by running a Resource Discovery Task using the following settings:

  • Select TCP Port scan
  •  Enter ports 5554,9996