W32/Sasser.worm.g

This Sasser variant functions similarly to previous variants, such as W32/Sasser.worm.f , with the following differences:

• This variant drops the W32/Netsky.AC@MM worm into the WINDOWS directory as skynet.cpl and executes it
• It copies itself to the WINDOWS directory as avserve3.exe and creates the following registry run key:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Run "avserve3.exe" = C:\WINDOWS\avserve3.exe

Presense of the file avserve3.exe and registry key:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Run "avserve3.exe" = C:\WINDOWS\avserve3.exe
  

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

The propagation mechanism is akin to that for previous variants:

• the worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.
• It creates a remote shell on TCP port 9996.
• Next it creates an FTP script named cmd.ftp on the remote host and executes it. Via the FTP script, the FTP.EXE application is used to retrieve the worm from the infected machine (port 9996) to the remote host. The worm is then executed.
• the FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as mentioned above) from the infected host.
• The infected host accepts this FTP traffic on TCP port 9996.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The worm scans public ranges like 10.0.0.0 and 192.168.0.0 only if they are part of the local subnet. The destination port is TCP 445.

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

• Insert the Windows XP CD into the CD-ROM drive and restart the computer.
• When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
• Select the Windows installation that is compromised and provide the administrator password.
• Issue 'fixmbr' command to restore the Master Boot Record
• Follow onscreen instructions.
• Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

• Insert the Windows CD into the CD-ROM drive and restart the computer.
• Click on "Repair Your Computer".
• When the System Recovery Options dialog comes up, choose the Command Prompt.
• Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
• Follow onscreen instructions.
• Reset and remove the CD from CD-ROM drive.