Virus Profile: W32/Sasser.worm.f

Threat Search
Virus Profile information details
Risk Assessment: Home Low-Profiled | Corporate Low-Profiled
Date Discovered: 5/10/2004
Date Added: 5/10/2004
Origin: Unknown
Length: 74,752 bytes (packed)
Type: Virus
Subtype: Internet Worm
DAT Required: 4288
Removal Instructions


This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

The virus copies itself to the Windows directory as NAPATCH.EXE and creates a registry run key to load itself at startup

    CurrentVersion\Run "napatch.exe" = %WinDir%\napatch.exe

As the worm scans random IP addresses, it listens on successive TCP ports starting at 1047.  It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.

A file named winlog2 is created on the root of the C: drive.  This file contains an IP address together with the number of machines infected.

Copies of the worm are created in the Windows System directory as #_up.exe.


  • C:\WINDOWS\System32\11583_up.exe
  • C:\WINDOWS\System32\16913_up.exe
  • C:\WINDOWS\System32\29739_up.exe

A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs.  The following Window may be displayed:


Methods of Infection

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

The propagation mechanism is akin to that for previous variants:

  • the worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.
  • It creates a remote shell on TCP port 9996.
  • Next it creates an FTP script named cmd.ftp on the remote host and executes it. Via the FTP script, the FTP.EXE application is used to retrieve the worm from the infected machine (port 9996) to the remote host. The worm is then executed.
  • the FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as mentioned above) from the infected host.
  • The infected host accepts this FTP traffic on TCP port 9996.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The worm scans public ranges like and only if they are part of the local subnet. The destination port is TCP 445.


Virus Characteristics

-- Update May 11, 2004 --
The assessment of this thread was updated to Low-Profiled due to media attention:

This new variant is similar to W32/Sasser.worm.a. It has been repacked using PECompact and is proactively detected as Exploit-DcomRpc using engine 4.3.20 together with DATs 4288 and above. This detection requires the scanning of compressed executables to be enabled

This variant differs from W32/Sasser.worm.a in the filename and registry keys it uses:

  • Uses the filename napatch.exe (74,752)

This self-executing worm spread by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]

Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.

Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:


All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

  • Insert the Windows XP CD into the CD-ROM drive and restart the computer.
  • When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  • Select the Windows installation that is compromised and provide the administrator password.
  • Issue 'fixmbr' command to restore the Master Boot Record
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

  • Insert the Windows CD into the CD-ROM drive and restart the computer.
  • Click on "Repair Your Computer".
  • When the System Recovery Options dialog comes up, choose the Command Prompt.
  • Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

PC Infected? Get Expert Help

Virus Removal Service

Connect to one of our Security Experts by phone. Have your PC fixed remotely - while you watch!