Alias:W32.Sasser.Worm
Type:Worm 
Size:58,880 Bytes 
Origin:unknown 
Date:08-26-2004 
Damage:causes functionality problems; prevents system shut-down. 
VDF Version:6.27.00.35 
Danger:Medium 
Distribution:Medium 

General DescriptionOperating systems:
Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, Windows XP, Windows Server 2003

DistributionIn order to spread itself, Worm/Sasser.G starts an FTP server on the infected computer. Then, it generates random IP addresses and tries to contact them. If this succeedes, the worm connects the IP address to the FTP server and sends copies of itself to the Client.

Technical DetailsWhen activated, Worm/Sasser.G copies itself as:
%Windir%\avserve3.exe
%Windir%\wserver.exe

Afterwards, it creates the following Win PE files, containing Worm/NetSky virus code:
%Windir%\skynet.cpl
%Windir%\comp.cpl

It makes the following registry entry, to ensure its activation on restart:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "avserve3.exe"="%Windir%\avserv3.exe"
"wserver"="%Windir%\wserver.exe"

Worm/Sasser.G uses two mutexes:
'PinaasoSky' and 'Jobaka3'
Die Beschreibung wurde erstellt von Crony Walker am Dienstag, 15. Juni 2004

zurück . . . .