Hello everyone! Today I have a very special worm video for you.
As you might recall if you've seen my question and answer video where I answered your questions for over an hour
I answered many times, that the very first piece of malware I was ever infected with was the Sasser worm in 2004
and that's what really made me interested in malware.
And today, April 30th, 2014 is the tenth year to the day
from when Sasser started spreading.
So I guess that marks the tenth day since I became interested...
Or tenth year, sorry...
since I became interested in malware and wanted to study it
and so, I figured I'd do a very special video today and...
Really, do an in-depth look of the Sasser worm.
So, here you can see we have a few news articles...
And forum posts... The only news article I have is here, this is from CNN as you can see.
Posted May 4th 2004,
and...
Basically, Sasser just spread very quickly, I mean...
*Very* quickly
quickly overwhelming the internet and was, pretty much everywhere...
And, if you hadn't patched your system, you'd be seeing symptoms of the worm
and, we also have a few forum posts...
They're all pretty much the same thing, just people seeing this message on their system.
They don't know why their system is shutting down
which we will see in a moment...
And, they're always running either: Windows 2000 or Windows XP...
So here's 2000...
This guy has Windows 2000 Professional, y'know...
Obviously, that is gonna change soon, he says he doesn't have an antivirus on it and...
You definitely wanna have an antivirus, especially back in the day
When, malware was *more* malicious in...
Just attempting to mess with your computer or your files,
rather than trying to make money as its doing nowadays.
And, this one... We are running XP...
His girlfriend... Is having issues with LSASS.EXE terminating and the system rebooting...
Post HijackThis log...
Remember HijackThis?
I don't know if people still use that but I remember people using that all the time a few years ago...
Another guy...
"Please help me! It's *very* annoying now, are there any patches or somethin'?"
And, yes there are...
Here's a DELL Latitude running Windows 2000, also being infected with the Sasser
and it's rebooting his computer at random times...
"The system just shuts down and reboots"
alright...
So... That's the kinda forward I wanted to get outta the way
and uh...
Just wanna take the time right now to thank you because I actually recently hit:
10,000,000 video views overall!
And, will soon be hitting 40,000 subscribers so...
Thank you all so much for continuing to watch and joining me on my malware adventures on YouTube.
I really do appreciate it.
Alright, so in the past there have been multiple incidences
in making my videos where virus authors have either divulged their name
or...
Printed it...
Or, there have been city names, from places that aren't... In the United States
and...
I am as pure blooded American as you will ever find and I cannot pronounce any of these names
and...
The worm author...
Of Sasser was actually arrested,
shortly after he released the worm
and...
Here's his name and I can't pronounce it, but I do have my good friend...
Monarch...
And, he is German and he is going to help us...
Today...
To pronounce his name...
So, Monarch...
How do you pronounce his name?
"Yea, well, you pronounce this name..."
"Sven Jaschan"
"Sven Jaschan"... I... See... I would've said like "Jaschan" or, "Jaschan" or something...
So, I'm glad I have you here...
Thank you... - "Yeah"
"And, you're welcome!"
Alright...
"Feels good to help you out on that..."
"Heh..."
Ah, no problem...
Monarch's a good friend of mine, he also helps me moderate over at MalwareUp
and uh...
Thanks for coming out...
I appreciate it...
"No problem..."
Alright, now we'll go ahead and demonstrate the worm infecting a PC...
As you can see here we have our Sasser executable on our desktop
and we're looking at the overview of CPU performance on the computer...
Lemme go ahead and run the worm
we'll see CPU usage jumps up immediately to 100%
as the worm uses all system resources available.
To, uh... Attempt to spread itself.
Which is its only purpose is to spread...
And, if you look in the uh... Processes list
Occasionally, you will see FTP.EXE pop up
This is from the FTP server that Sasser launches in order to spread itself.
When it finds a computer that is vulnerable...
It will open up,
the FTP server and send it's files on over...
And, as you can see here, this is the main symptom you'll notice on computers infected with Sasser,
LSA Shell (Export Version) will crash,
and will need to be closed and this pops up every time the computer is started.
Sasser also drops a win2.LOG file, as you can see here.
And... I have my text formatting a little off,
but it's... pretty much made to be a list of IP addresses that Sasser has infected.
However, I'm not sure if its working correctly as,
All of them on all of the computers I've seen start with a 4-digit...
Initial...
IP address, which... Isn't possible
Initially, it drops it's file: the worm body as avserve2.EXE meaning this might be the B variant of Sasser
In the C:\WINDOWS directory.
It's about 16 kilobytes, not very large. Since all its supposed to do is spread...
And here we can see once again; the LSA Shell (Export Version) has crashed and needs to close.
This is from LSASS.EXE - a critical Windows process, dealing with file permissions and basically; owners of processes.
Sasser exploits a vulnerablility in this process to spread
and, the author actually reverse engineered a patch from Microsoft that fixed this issue,
and then, made the worm utilize that vulnerablility and was able to spread to *millions* of PCs around the world.
And here is the final symptom you'll see on systems infected with Sasser.
You get a System Shutdown dialog box telling you that LSASS has crashed and you have 60 seconds,
to save all your work and shutdown the PC or it will do it for you.
So, if you don't save you will lose any work
but...
Pretty much when Sasser infects a system, since it's using all the system resources, the computer is,
practically unusuable.
It hogs every thing for itself and every thing becomes slow and unresponsive,
and, generally is a pain in the ass to use.
If we go to the shutdown dialog box,
we will see that because LSASS has crashed, we can no longer shutdown or restart the computer,
we can only switch users or log off.
This is because LSASS determines who has permissions on the computer and when it crashes,
you no longer have permissions to restart.
So, as you can see once the timer is up, the computer reboots and it starts Windows.
We're loading back into Windows now...
And remember that the worm has dropped its files to the system, so that it will start automatically.
Now that it has infected it,
if we look at Task Manager, we can see it has started from the avserve2.EXE process,
and...
Once again, you can see the FTP process; starting up...
Now, already we see that LSASS has crashed, due to the worm.
And we can see CPU usage is sitting once again at 100%,
steady, it... Won't go down...
And, we can see that Task Manager is now no longer responding which is never a good sign,
the worm is using so many resources that we cannot use Task Manager effectively,
to do anything to the system.
Clickin' around...
I'll have to end Task Manager because it's not responding...
And, even that takes forever...
"You chose to end the non-responsive program, Windows Task Manager"
and as you can see we can already see the System Shutdown starting...
As you can see, I have a small network here setup,
we'll go ahead and go through the computers that are listed here...
On the floor is a DELL Optiplex, actually gifted to me by my friend Landon who used to be a co-worker at,
PIZZA-Hut.
And, this will be the source of the infection, you can see it on the first monitor on the left here,
and as we pan up, we can see the rest of the computers, that are sitting in our network
The big white box; computer number 2 - you might know it from my earlier videos as actually the Gateway PC.
That was featured in a lot of my early videos,
computer 3 is a DELL Optiplex that used to belong to my father about...
Ten?
Fifteen?
Nah... Ten years ago...
Yeah...
Ten years ago.
And...
Pretty much just hang on to it, and...
Using it now for this video.
Computer number 4 is a DELL Latitude laptop that I purchased off eBay about 6 months ago or so...
It's from 2002, pretty low-specced, pretty slow and it's perfect for this video.
And, last but not least... Is a TOSHIBA Tecra 720CDT,
which, was also...
Owned by my dad... and,
this is pretty much been owned since it was new so, probably since 1995 or so.
So, it used to be - whenever this computer came out - this laptop came out, is when we bought it.
And...
Pretty much, just been around since then and its running Windows 2000, upgraded from Windows 95.
So, now we'll go ahead and run the worm.
And...
Now that we've run it, it's simply a matter of waiting and seeing which of the computers it'll infect next,
over a period of time.
So, as we can see, it takes about 5 minutes and 23 seconds,
for the first computer to be found and infected, and in this case, it was our Gateway PC - computer 2.
So, when the worm infects another computer,
it first scans for all IP addresses it can think of,
and when it finds a computer on the other end it checks for vulnerabilities.
And, if it finds this particular LSASS vulnerability it wants to spread,
it will exploit it, open up an FTP server and send the worm over to the victim,
which will then execute the worm and continue spreading from that computer.
So, the worm spreads without any human intervention whatsoever,
which made it spread *very*, very quickly.
At about 7 minutes, we see the worm make the jump to the DELL Latitude laptop - computer 4.
And, it is also infected and once again, you see the CPU usage rise in Task Manager.
And, the worm will begin spreading from that computer as well, so now we have 3 computers on this network,
scanning and attacking, victim PCs.
It takes a little while longer but we can see at 13 minutes and 30 seconds,
computer 3 begins to be infected the uh... old DELL Optiplex that I have.
So, now there are 4 computers on this network that are infected,
and, they're all the XP computers funnily enough.
Finally, at 14 minutes and 20 seconds, we see the Windows 2000 computer pop-up,
with the shutting down message.
As, Windows 2000 is also vulnerable to this particular LSASS exploit.
However, this machine unlike the Windows XP machines, doesn't actually receive the file infection,
it just gets knocked offline by the worm.
So, it doesn't actually open the FTP server and download avserve2.EXE,
but it will get booted offline as long as the exploit is not patched and as long as its not hooked up to a firewall,
while it's on the internet.
So, while Windows 2000 won't actually be infected by the worm, it will be effected directly by it.
So, now we can see in under 15 minutes, all 5 of these computers have been infected by Sasser.
And, now all of them will reboot continuously until they are cleaned.
And, I know a lot of you have expressed interest in removal portions of videos,
so, I'm actually going to include one right now,
and, we'll see what it takes to actually remove the worm.
Removal is actually quite simple but very tedious, especially on a large network.
If we go ahead and go to the run prompt and start up the Command Prompt and uh... Move the System Shutdown,
dialog box outta the way.
We can actually stop the shutdown timer,
with the command: shutdown -a - as I'm sure many of you know.
Once entered, the command stops... The shutdown process.
However, now the system is pretty unstable since we're running without LSASS.EXE.
If we go and look at REGEDIT in the uh... HKEY_LOCAL_MACHINE, CurrentServer, Run,
where it starts up... files on... boot up, we can see avserve.EXE has been added here.
If we look at Task Manager now, we can see that all processes are running from unknown users since all,
attributions of ownership are gone.
We can end the worm process.
Give it a few minutes, few seconds and we can see the CPU usage instantly drops back down to normal levels,
since the worm has... stopped.
Once the worm has stopped, we can remove it's registry key, which prevents it from running on boot up.
Now, we can just remove the files that the worm drops on the system.
Delete, win2.LOG
Then delete avserve2.EXE from the WINDOWS folder.
Now, clean-up is complete however, you really should patch your system,
as you can see LSASS is still crashed so we'll need to turn off the computer using the power button,
instead of the shutdown... menu.
Now, in order to prevent re-infection, you'll need to install updates from Windows on your computer.
And...
Pretty much, obtain a firewall or any antivirus that contains a firewall to prevent future re-infections.
Now that our computer has booted up once again,
you can go down to Task Manager and take a look and we'll see that CPU usage is normal.
Idling at about 2% - 0%.
And, the worm is no longer listed in the processes list.
Now, you'd have to repeat that removal process if you didn't have an automatic tool,
on every computer on your network that got infected, which might be a bit of a pain.
That about wraps it up for the Sasser worm video.
Thank you all so much for joining me on this video and thanks again for helping me reach 10,000,000 overall
video views.
Here's looking forward to the next 10,000,000 and to the next virus video review.
Thanks again, guys!