OT: found new worm-virus

Rob Goodale rrg@unlv.nevada.edu
Tue, 11 May 2004 09:57:12 -0700


This is a multi-part message in MIME format.

---------------------- multipart/alternative attachment
OT: Everyone beware there is a new really bad bug out there.  I got it =
last night and it took quite a while to get rid of it.  Yuck!

It is called the "Sasser" worm, also known as "lasss".  It is a mutated =
form of some other past viruses but this version is very sneaky.  Forget =
about not opening attachments, that's not how this one spreads.  It =
resides inside networks, typically dial-up but can be in others.  =
According to Norton it apparently it hides in vulnerable networks that =
haven't been patched for it.  It enters when you log on.  Last night I =
logged onto the university system, (they give me a free dial-up =
account).  Within seconds a box popped up saying:
DOWNLOAD: 1423lasss.e.exe.
My computer started acting funny immediately.  I had updated Norton =
Anti-Virus just the day before.  I updated it again and it immediately =
found it.  The definition log said that it was only discovered by Norton =
on may 8th.  The bug replicates itself in a hurry.  By the time I ran =
Norton a second time it had already created over 250 duplicates on my =
computer!!!  This is a new computer and I just loaded Windows XP on it =
about 3 days ago!

If you are using XP I suggest you update and run your virus software =
ASAP.  One way you can check to see if you have it right now, (although =
it can still hide in other ways), is to hit your Ctrl+Alt+Delete and =
check the "processes running" box.  Look for lasss,  (may have a number =
in front), or something to the effect of Download.exe (may also have a =
number in front of it).

NOTE:  There is a program process that is suppose to be there and may be =
running called lasse, that's not it.  This one will have three S's.  If =
you have it clean it off immediately, Norton says it will eventually =
make your computer shut down and you won't be able to restart it!!!


Rob Goodale, RPT
Las Vegas, NV
---------------------- multipart/alternative attachment
An HTML attachment was scrubbed...
URL: https://www.moypiano.com/ptg/pianotech.php/attachments/c4/c8/20/e1/attachment.htm

---------------------- multipart/alternative attachment--



This PTG archive page provided courtesy of Moy Piano Service, LLC