W32.Sasser Worm Fix Information

I've already fixed three of these this morning, so just in case the information proves useful to anyone else...

This exploits a Local Security Authority Subsystem Service (LSASS) vulnerability on TCP Port 139. MS04-011 security patch fixes the vulnerability. Personal firewalls will block the threat

Removal tool at www.microsoft.com/downloads/details.aspx...4CC17&displaylang=en

Knowledge Base article KB841720 is at support.microsoft.com/default.aspx?scid=kb;EN-US;841720

Enjoy! :x :x

Talking about timing! I just posted Neon's news submission on the worm!

Thanks for the notification Bishop!

The worm spread quite quickly huh (well as far as I know many people I know their gateway has got the worm and they don't run a firewall?)? you would think after the worm breakouts that don't require you to run a program to be infected people would install a personal firewall but oh well...

This site should actually scan your computer and say "HEY did you know that you don't have a firewall " but I'm sure that would have some privacy issues.

as Chris said thanks 4 the info Bishop (should have posted the removal tool link in the news post eh? )

Interestingly Neon, Chris and I have been discussing allowing security scans from teh website using nmap in a PHP script.. just like what you're talking about

Alright if anyone has access to an infected PC could you please please mail me the binary before you clean the system. I want a copy of the worm itself.. (avserve.exe) so that I can run it in a controlled environment and disassemble it.. then perhaps I can cook up a little cleanup tool of our own.

So if you have it.. Personal Message me, or reply to this post and I'll give you an address to mail it to.

Cheers,

Just don't attach any worms. :lol:

Does any one actually use LSASS in the real world?
Do you remember the days when unix boxes had all those fun services running on them, like wall and chargen? Seems to me that now it's a case of just have the ports open that you actually want to use, and shut the rest off. That's common practice in a unix environment, but what about Windows? I know that a personal firewall blocks them, but should we be actually hardening our boxes by shutting down some of the surplus services on them? You never know, the things might run better! Any opinions, and which services would be candidates for the chop? :twisted: