The FBI said Monday its agents are leading a task force trying to track down the origins of the worm. As Sasser moves from machine to machine, it is also possible to remotely take over control of a user's computer.
One symptom is that the computer may restart every time the user tries to go online. Users could be affected without knowing it. That means there's often much more to do than simply install the patch to both stop the worm and make sure other computer systems are not compromised. But in large corporate computer systems, these patches can have an impact on other internal systems. Microsoft issued a patch, or fix, for this vulnerability April 13. Then it copies itself into the Windows directory as an executable file, and is launched the next time the computer is booted. Sasser scans random internet protocol addresses until it finds a vulnerable system. Sasser spreads through a Windows vulnerability known as LSASS, or Local Security Authority Subsystem Service. While a computer virus requires some sort of human intervention to be launched, such as opening an e-mail, a worm takes off on its own. The Sophos spokesman said the Taiwanese Post Office, the train system in Sydney, Australia, and several banks in Scandinavia have been infected by the Sasser worm. He says hidden in the code of Netsky-AC is a sarcastic message directed toward antivirus companies, claiming responsibility for both. "The very worst thing you can do is fall for this trick by clicking on the attached file," he said.Ĭluley said there may be a connection between the creators of Sasser and Netsky. "It really preys on paranoia about the Sasser worm," said Graham Cluley, senior technology consultant for the computer security firm Sophos. In a new, cunning twist by virus writers, an e-mail in wide circulation that purportedly offers a "fix" for the Sasser worm actually infects the user's computer with a different virulent worm, known as Netsky-AC. "It's pretty aggressive, and it's replicating very quickly," said Steven Sundermeier, a security expert at Central Command, a computer security company based in Medina, Ohio. Other Windows systems, including Windows 95, 98 and ME, could be indirectly affected. Known as SasserA, SasserB, SasserC and SasserD, the worm is targeting Windows 2000 and Windows XP. (CNN) - Computer security experts are dealing with at least four variants of a worm that is spreading quickly through Windows operating systems.
0 kommentar(er)
