View Full Version : What's the deal with Sassar virus?


Aldeth the Foppish Idiot
Tue, 4th May '04, 2:25pm
What does this thing actually do? I hear it makes your system shut down, but it doesn't erase any files. If that's the worst that happens, it is rather an innocuous virus. Does anyone know if it does anything more than that?

I also have one question. It says the virus affects people with operating systems of Windows XP and Windows 2000. I have Windows Me, but I have never been able to determine if Windows Me is the same as Windows 2000. Does anyone know this, as it will largely determine whether or not my home computer could become affected.

Wordplay
Tue, 4th May '04, 3:33pm
For one, those computers have to be rebooted. Might not sound much, but when there is over a thousand machines, it means a lot of work. Just today one of finnish banks, Sampo, had to close ALL of its offices to repair the network.

Hopefully they are smart enough to move on Linux soon -Xandros Desktop could be Windows, when it comes to office use...

Windows ME is almost the same as Windows 98, which is just a updated Windows 95 ;) Windows 2000 is a developed Windows NT. To answer your question: no, your home computer cannot be infected, if the virus can contaminate only Win2k, WinNT, or WinXP machines.

Taluntain
Tue, 4th May '04, 4:50pm
Click here (http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx) for more info.

ejsmith
Thu, 6th May '04, 3:34am
Yeah, it's a vulnerability in windows NT. So, that cover NT 4.0, NT 5.0, NT5.1. I've no idea what version NT that Win2k3 is, but it's vulnerable too.

It's a lsass hole, which is a basic part of the entire operating system. If you plug your computer into the net, you're vulnerable. You don't have to be running anything special or doing anything right/wrong or logged in as root. You could be logged in as a guest and your computer is vulnerable.

Since it's only been a week or so since I last crashed my computer, I'll list what I have burned off to dvdr:

Serivce Pack 1 (I have SP1, not SP1a)
Autopatcher 4.5 (the Feburary edition)
KB837009
kb837001
kb828741
kb835732
kb832483

All that put together is about 360meg, or so. The SP1 and Autopatcher are nearly automatic, so you can run them and walk away from the computer for a little while. Makes patching nice. Also, if you get a virus or worm, you can pull your network plug, and crash/restore your machine without worrying about being infected again when you try to connect to winupdate.

Also, shutting down all the un-needed services helps out a lot. Stuff that you just have no use for, disable it in the hardware profile. Don't bother stopping things, just disable them and reboot into a nice, clean state.