Before using the tool please read the disinfection instructions
from 'f-sasser.txt'.
Manual Disinfection
To manually disinfect an infected system, first apply the Microsoft
patch MS04-011, then use Task Manager to kill the "avserve.exe" process,
then delete the file AVSERVE.EXE from your Windows directory and reboot.
To ensure that only one copy of the worm is running it creates a
mutex named 'Jobaka3l'.
Network Propagation
Sasser exploits the the MS04-011 (LSASS) vulnerability to gain
access the remote systems. The worm starts 128 scanning threads
that try to find vulnerable systems on random IP addresses.
Computers are probed on port 445 which is the default port for
Windows SMB communication on NT-based systems.
The probing might crash unpatched computers.
Under Windows 2000, users can see a Windows error message like this:
Under Windows XP, users can see a Windows error message saying:
LSA Shell (Export Version) has encountered a problem
and needs to close. We are sorry for the inconvenience.
When attacking the worm first determines the version of the
remote operating system then uses the appropriate parameters
to attack the host.
Different parameters are used for
- Windows XP (universal exploit)
- Windows 2000 (universal exploit)
- Windows 2000 Advanced Server (SP4 exploit)
Other operating systems, such as Windows Me and NT are not infected by this worm.
If the attack is successful a shell is started on port 9996.
Through the shell port Sasser instructs the remote computer to
download and execute the worm from the attacker computer using
FTP. The FTP server listens on port 5554 on all infected computers
with the purpose of serving out the worm for other hosts that
are being infected. Transactions through the FTP server are
logged to 'C:\win.log'.
Summary of TCP ports used by the worm:
445/TCP:
- The worm attacks through this port
5554/TCP:
- FTP server on infected systems
9996/TCP:
- Remote shell opened by the exploit on the vulnerable hosts
The Vulnerability
This vulnerability is caused by a buffer overrun in the Local Security
Authority Subsystem Service of Windows NT-based systems.
Detailed information on the vulnerability and the available fixes
are at
