Howdy,

More details on how the Sasser.D worm spreads:

If you think that you may be infected with this threat, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present.

Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx


This variant of W32/Sasser.worm functions in a similar fashion as the original variant, with the following exceptions.

This variant spreads with the filename SKYNETAVE.EXE (16,384 bytes)
It sends ICMP echo packets to discover potential victims
It creates a remote shell on TCP Port 9995 rather than 9996
This self-executing worm spread by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]

Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.

Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx


Indications of Infection

The virus copies itself to the Windows directory as SKYNETAVE.EXE and creates a registry run key to load itself at startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsCurrentVersion\Run "skynetave.exe" = %WinDir%\skynetave.exe
As the worm scans random IP addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9995.

A file named win2.log is created on the root of the C: drive. This file contains an IP address together with the number of machines infected.

Copies of the worm are created in the Windows System directory as #_up.exe. (Where '#' represents a string 4 or 5 digits.)

Examples

c:\WINDOWS\system32\26347_up.exe
c:\WINDOWS\system32\5157_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs.


Method of Infection

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

The propagation mechanism is akin to that for previous variants:

the worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.

It creates a remote shell on TCP port 9995.

Next it creates an FTP script named cmd.ftp on the remote host and executes it. The specified DATs contain detection for this FTP script as W32/Sasser.worm!ftp . Via the FTP script, the FTP.EXE application is used to retrieve the worm from the infected machine (port 5554) to the remote host. The worm is then executed.

Ththe FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as mentioned above) from the infected host.

The infected host accepts this FTP traffic on TCP port 5554.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The worm scans public ranges like 10.0.0.0 and 192.168.0.0 only if they are part of the local subnet. The destination port is TCP 445.



Removal Instructions


Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Additional Windows ME/XP removal considerations

McAfee Stinger
Stinger has been updated to assist in detecting and repairing this threat.

Manual Removal Instructions
To remove this virus "by hand", follow these steps:

Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file SKYNETAVE.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "SKYNETAVE.EXE" value from
HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftWindows\CurrentVersion\Run
Reboot the system into Default Mode


Aliases

W32.Sasser.D (Symantec), W32/Sasser-D (Sophos), W32/Sasser.D (F-Prot), WORM_SASSER.D (Trend)


Ciao...