W32.Sasser.F.Worm is a variant of
W32.Sasser.Worm. This worm attempts to exploit the LSASS vulnerability
described in Microsoft Security Bulletin MS04-011. It spreads by scanning
randomly selected IP addresses for vulnerable systems.
W32.Sasser.F.Worm differs from
W32.Sasser.Worm as follows:
Uses a different mutex: billgate.
Uses a different file name:
napatch.exe.
Creates a different value in the
registry: "napatch.exe."
Notes:
The MD5 hash value of this worm is
0x9d8d3837ef0dca757231349b5f81f26e.
Block TCP ports 5554, 9996, and 445 at
the perimeter firewall and installs the appropriate Microsoft patch
(MS04-011) to prevent the remote exploitation of the vulnerability.
W32.Sasser.F.Worm can run on, but not infect, Windows 95/98/Me computers.
Although these operating systems cannot be infected, they can still be
used to infect the vulnerable systems to which they are able to connect.
In this case, the worm will waste a lot of resources so that programs
cannot properly run, including our removal tool. (On Windows 95/98/Me
computers, the tool should be run in Safe mode.)
blended
threat exploits one or more network services, disable, or block
access to, those services until a patch is applied.
Always keep your patch levels
up-to-date, especially on computers that host public services and are
accessible through the firewall, such as HTTP, FTP, mail, and DNS
services.
Enforce a password policy. Complex
passwords make it difficult to crack password files on compromised
computers. This helps to prevent or limit damage when a computer is
compromised.
Configure your email server to block or
remove email that contains file attachments that are commonly used to
spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to
prevent further compromising your organization. Perform a forensic
analysis and restore the computers using trusted media.
Train employees not to open attachments
unless they are expecting them. Also, do not execute software that is
downloaded from the Internet unless it has been scanned for viruses.
Simply visiting a compromised Web site can cause infection if certain
browser vulnerabilities are not patched.
What to do if the computer shuts down before you can patch or get the
tool
This threat can cause Windows to keep shutting down and restarting. This
can prevent you from installing the Microsoft patch or downloading the
tool described below. To prevent the shut down, do the following. (You may
have to try this several times, as you only have about 20 seconds to do
steps 3 to 6.) (This will not work on Windows 2000.)
Disconnect the computer from the
network/Internet connection. (Disconnect the cable if necessary.)
Restart the computer.
As soon as Windows opens and you see
the Windows desktop, click Start > Run.
Type:
cmd
and press Enter.
Type:
shutdown -i
and press Enter.
In the Remote Shutdown Dialog that
opens, change 20 seconds to:
9999
and click OK.
This gives you about three hours to get the patch installed, update
the definitions, and so on.
Reconnect the network/Internet
connection.
Connect to the Internet, and get the
patch. Then continue with the steps described below.
When you have patched for and removed the threat, you can re-enable the
20-second default warning if you want to.
The following instructions pertain to all current and recent Symantec
antivirus products, including the Symantec AntiVirus and Norton AntiVirus
product lines.
End the malicious process (Windows
NT/2000/XP).
Disable System Restore (Windows XP).
Update the virus definitions.
Run a full system scan and delete all
the files detected as W32.Sasser.F.Worm.
Reverse the change made to the
registry.
For details on each of these steps, read the
following instructions.
1. To end the malicious process
On Windows NT/2000/XP computers, you must first end the malicious process.
Follow these instructions:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column
header to alphabetically sort the processes.
Scroll through the list and look for
the following processes:
napatch.exe
any process with a name consisting
of four or five digits, followed by _up.exe (for example,
74354_up.exe).
If you find any such process, click
it, and then click End Process.
Exit the Task Manager.
2. To disable System Restore (Windows XP)
If you are running Windows XP, we recommend that you temporarily turn off
System Restore. Windows XP uses this feature, which is enabled by default,
to restore the files on your computer in case they become damaged. If a
virus, worm, or Trojan infects a computer, System Restore may back up the
virus, worm, or Trojan on the computer.
Windows prevents outside programs, including antivirus programs, from
modifying System Restore. Therefore, antivirus programs or tools cannot
remove threats in the System Restore folder. As a result, System Restore
has the potential of restoring an infected file on your computer, even
after you have cleaned the infected files from all the other locations.
Also, a virus scan may detect a threat in the System Restore folder even
though you have removed the threat.
For instructions on how to turn off System Restore, read your Windows
documentation, or "How
to turn off or turn on Windows XP System Restore" Note: When you are completely
finished with the removal procedure and are satisfied that the threat has
been removed, re-enable System Restore by following the instructions in
the aforementioned documents.
3. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for
quality assurance before they are posted to our servers. There are two
ways to obtain the most recent virus definitions:
Running LiveUpdate, which is the
easiest way to obtain virus definitions: These virus definitions are
posted to the LiveUpdate servers once each week (usually on
Wednesdays), unless there is a major virus outbreak. To determine
whether definitions for this threat are available by LiveUpdate, refer
to the Virus Definitions (LiveUpdate).
Downloading the definitions using the
Intelligent Updater: The Intelligent Updater virus definitions are
posted on U.S. business days (Monday through Friday). You should
download the definitions from the Symantec Security Response Web site
and manually install them. To determine whether definitions for this
threat are available by the Intelligent Updater, refer to the Virus
Definitions (Intelligent Updater).
If any files are detected as infected
with W32.Sasser.F.Worm, click Delete.
5. To reverse the change made to the registry WARNING:
Symantec strongly recommends that you back up the registry before making
any changes to it. Incorrect changes to the registry can result in
permanent data loss or corrupted files. Modify the specified keys only.
Read the document, "How
to make a backup of the Windows registry," for
instructions.
Click Start, and then click Run. (The
Run dialog box appears.)
