Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Fast-Spreading Worm Has Infected As Many As 1 Million PCs: Page 3 of 4

Dunham and others said that the Sasser worm may be the work of the same group that crafted a recent Netsky worm. According to analysis done by the Finnish anti-virus firm F-Secure, the most recent Netsky worm, dubbed Netsky.ac--which went wild Sunday--includes text embedded in its code that reads:

"Hey, av firms, do you know that we have programmed the sasser virus?!?. Yeah that's true! Why do you have named it sasser? A Tip: Compare the FTP-Server code with the one from Skynet.V!!! LooL! We are the Skynet..."

If true, said Dunham, expect more variants of Sasser to appear, and appear quickly. One of the Netsky worm line's distinguishing traits is its numerous variations, with new copies released weekly, and in some cases, daily. "The worm is highly successful and attackers are updating its code as we speak, so you can expect to see a lot more in the coming days. This could be a major development in the worm war."

Currently, security firms have tagged Sasser.b as the most prevalent and dangerous. Symantec Corp. has labeled Sasser.b as a 4 in its 1-through-5 scale--it has never ranked a worm or virus as a 5. Sasser.a, however, is rated as a 3, while Sasser.c and Sasser.d are now at 2. Rival McAfee, used describe Sasser.a's and Sasser.b's threat as Medium, and called Sasser.c and Sasser.d a Low danger.

To defend against Sasser, users should immediately patch all vulnerable PCs.