Home Malware Programs Worms Worm.Sasser.E

Worm.Sasser.E

Posted: April 25, 2007

Threat Metric

Threat Level: 9/10
Infected PCs: 46
First Seen: July 24, 2009
OS(es) Affected: Windows

Worm.Sasser.E is a parasite classified as a worm virus. Once installed on system, Worm.Sasser.E
Will launch automatically with every Windows boot. The worm will tend to call the AbortSystemShutdown API with a purpose to disable the function of restarting and shutting down your machine. After two hours, the Worm.Sasser.E will show the following messages on your screen: "Your computer is affected by the MS04-011 vulnerability," "It can be that dangerous computer viruses similar the Blaster worm infect your computer," "Please update your computer with the MS04-011 LSASS patch from the www.microsoft.com website," "This is an message from the SkyNet Team for malicious activity prevention". Worm.Sasser.E will also create an FTP server on TCP port 1023, which is used to distribute itself to other PCs. This worm distributes by making a security hole in Windows LSASS.

Loading...