Dunham and others said that the Sasser worm may be the work of the same group that crafted a recent Netsky worm. According to analysis done by the Finnish anti-virus firm F-Secure, the most recent Netsky worm, dubbed Netsky.ac--which went wild Sunday--includes text embedded in its code that reads:
"Hey, av firms, do you know that we have programmed the sasser virus?!?. Yeah that's true! Why do you have named it sasser? A Tip: Compare the FTP-Server code with the one from Skynet.V!!! LooL! We are the Skynet..."
If true, said Dunham, expect more variants of Sasser to appear, and appear quickly. One of the Netsky worm line's distinguishing traits is its numerous variations, with new copies released weekly, and in some cases, daily. "The worm is highly successful and attackers are updating its code as we speak, so you can expect to see a lot more in the coming days. This could be a major development in the worm war."
Currently, security firms have tagged Sasser.b as the most prevalent and dangerous. Symantec Corp. has labeled Sasser.b as a 4 in its 1-through-5 scale--it has never ranked a worm or virus as a 5. Sasser.a, however, is rated as a 3, while Sasser.c and Sasser.d are now at 2. Rival McAfee, used describe Sasser.a's and Sasser.b's threat as Medium, and called Sasser.c and Sasser.d a Low danger.
To defend against Sasser, users should immediately patch all vulnerable PCs.