[an error occurred while processing this directive]
BBC News
watch One-Minute World News
Last Updated: Tuesday, 4 May, 2004, 09:29 GMT 10:29 UK
Sasser net worm disruption grows
Computer keyboard, AP
Many versions of Windows are at risk from Sasser
The Sasser worm is continuing to cause disruption for large numbers of Windows PC users.

The first version of the malicious program was discovered on 1 May and since then has spread widely across the internet.

In at least seven cases, disruptions at large companies have been blamed on machines infected by Sasser.

Unlike more recent viruses, Sasser does not travel by e-mail instead it makes its way around the web unaided.

Shut down

The virus can infect PCs running Windows 2000 and XP that are not patched against the loophole it exploits.

According to anti-virus firms machines running Windows 95, 98 and Millennium Edition can help spread Sasser even though they cannot be infected by it.

The security firms urged users to install the latest security patches from Microsoft and advised home broadband users to install and run a firewall.

The virus is called a worm because it searches out machines to infect by itself without any help from users.

So far four variants of Sasser have been seen in the wild.

Loveletter virus in e-mail inbox, Ap
Sasser struck almost exactly 4 years after the Iloveyou bug
The latest version, Sasser.D, scans so aggressively for new computers to infect that it may cause networks to become congested with packets of data and slow down.

Poor programming by Sasser's creator makes infected machines shut down.

Microsoft and many security firms have released tools that help people find out if they are infected and to help them remove the virus from their system.

Users hit

Early reports suggest that home users will be hit hardest as many broadband users do not have a firewall fitted that would protect them from malicious programs like Sasser.

F-Secure said that many large companies had already installed the patch for the vulnerability Sasser exploits which may limit the ultimate spread of the worm.

Those that had not patched have been hit hard.

Taiwan's national post office said 1,600 of its machines were hit by the virus which forced more than 400 of its 1200 branch offices to revert to pen and paper.

The disruption left customers queuing in long lines at many of the company's offices, according to television reports.

Windows XP on sale, PA
Unpatched versions of Windows XP are vulnerable
Two Hong Kong government departments and some hospitals on the island were hit by the virus.

In Australia Railcorp trains were halted apparently because a virus disrupted the radio systems and stopped drivers talking to signalmen.

Also in Australia Westpac Bank staff were forced to use manual methods to record transactions as the virus made computers unusable. Two other banks reported infections.

Meanwhile, Finnish bancassurer Sampo said it had temporarily closed all its 130 branch offices as a precaution against Sasser.

US airline Delta would not comment on reports that the virus caused disruption to its schedule.

Patch here

Microsoft played down reports that millions were being infected by Sasser.

It reported that almost four times as many PC owners were downloading patches for security problems now compared to Autumn in 2003.

A patch for the vulnerability Sasser exploits was first released on 13 April and then updated on 28 April.

Holidays in the UK, parts of Europe and Japan may also help to limit the spread of the worm.

Some security experts said that using Sasser removal tools may not end the trouble because many of those caught out by it have also been infected by other viruses.

Creators of other malicious programs are trying to cash in on the success of Sasser.

The latest version of the Netsky virus, the 29th variant, travels with a file that claims to be a cure for Sasser sent out by anti-virus firms.

Inside this version the creators of Nestky claim that they were responsible for making Sasser too.


WATCH AND LISTEN
The BBC's Kevin Anderson
"Computers only need to be switched on and online to become infected"



SEE ALSO:
Sasser worm 'spreading rapidly'
02 May 04  |  Technology
Online virus war is slowing down
26 Mar 04  |  Technology
Pesky Netsky tops virus warnings
02 Mar 04  |  Technology
More virus misery for mail users
26 Feb 04  |  Technology
Mydoom mutants mount new attacks
10 Feb 04  |  Technology


RELATED INTERNET LINKS:
The BBC is not responsible for the content of external internet sites


PRODUCTS AND SERVICES

News Front Page | Africa | Americas | Asia-Pacific | Europe | Middle East | South Asia
UK | Business | Entertainment | Science/Nature | Technology | Health
Have Your Say | In Pictures | Week at a Glance | Country Profiles | In Depth | Programmes
Americas Africa Europe Middle East South Asia Asia Pacific