The Hunter
May 12th, 2004, 04:47 PM
LONDON — A new variant of the Sasser worm has appeared, even though the worm's author has apparently been arrested in Germany last week.
Antivirus companies suspect that a copycat coder has written the new virus.
Systems infected with the Sasser worm randomly scan local networks and the Internet to look for Windows PCs that have not been updated with the latest Microsoft patch. The worm functions in a very similar way to the MSBlast worm, which caused millions of dollars in damage and disruption last summer.
A teenager suspected of writing the Sasser code has been arrested by police in Germany. Since his arrest, two variants of the worm have been detected in the wild. The suspected author had confessed to German police that he had released the fifth version of the worm, Sasser.E, four days before he had been taken into custody. Antivirus firms didn't detect the variant until the day after the arrest. The most recent, Sasser.F, was first detected Tuesday.
Luis Corrons, head of antivirus company Panda's research labs, said the Sasser.F worm's source code looks like it was written by an inexperienced programmer who has slightly modified the original code but had not added any new functions or behaviours.
Read more here:http://www.globetechnology.com/servlet/story/RTGAM.20040512.gtsass0512/BNStory/Technology/
Antivirus companies suspect that a copycat coder has written the new virus.
Systems infected with the Sasser worm randomly scan local networks and the Internet to look for Windows PCs that have not been updated with the latest Microsoft patch. The worm functions in a very similar way to the MSBlast worm, which caused millions of dollars in damage and disruption last summer.
A teenager suspected of writing the Sasser code has been arrested by police in Germany. Since his arrest, two variants of the worm have been detected in the wild. The suspected author had confessed to German police that he had released the fifth version of the worm, Sasser.E, four days before he had been taken into custody. Antivirus firms didn't detect the variant until the day after the arrest. The most recent, Sasser.F, was first detected Tuesday.
Luis Corrons, head of antivirus company Panda's research labs, said the Sasser.F worm's source code looks like it was written by an inexperienced programmer who has slightly modified the original code but had not added any new functions or behaviours.
Read more here:http://www.globetechnology.com/servlet/story/RTGAM.20040512.gtsass0512/BNStory/Technology/