This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
The virus copies itself to the Windows directory as LSASSS.EXE
and creates a registry run key to load itself at startup
CurrentVersion\Run "lsasss.exe" = %WinDir%\lsasss.exe
The virus attempts to remove the following registry keys, used by various Bagle virus variants:
As the worm scans random IP addresses, it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 1023, and creates a remote shell on TCP port 1022.
A file named ftplog.txt
is created on the root of the C: drive. This file contains an IP address together with the number of machines infected.
Copies of the worm are created in the Windows System directory as #_up.exe. (Where '#' represents a string 4 or 5 digits.)
A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs. The following Window may be displayed:
The worm contains the following message:
|1. Your computer is affected by the MS04-011 vulnerability
2. It can be that dangerous computer viruses similar
the Blaster worm infect your computer
3. Please update your computer with the MS04-011 LSASS patch
from the www.microsoft.com website
4. This is an message from the SkyNet Team for
malicious activity prevention
Methods of Infection
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
The propagation mechanism is akin to that for previous variants:
- the worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.
- It creates a remote shell on TCP port 1023.
- Next it creates an FTP script named cmd.ftp
on the remote host and executes it. Via the FTP script, the FTP.EXE application is used to retrieve the worm from the infected machine (port 1023) to the remote host. The worm is then executed.
- the FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as mentioned above) from the infected host.
- The infected host accepts this FTP traffic on TCP port 1023.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The worm scans public ranges like 10.0.0.0 and 192.168.0.0 only if they are part of the local subnet. The destination port is TCP 445.
W32/Sasser.worm.g (SARC) 15,873 byte sample