W32/Sasser.G is a worm. This worm is a variant of W32/Sasser. The worm infects systems running on Windows 2000/XP/2003. The worm spreads through networks. This worm exploits LSASS vulnerability present in Windows as explained by Microsoft Security Bulletin MS04-011.

Upon execution of the worm, it modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm opens ftp port 1023 and randomly scans for the computers with this flaw on the network. If found then the worm creates a remote access through TCP 1022 then downloads the file lsasss.exe to Windows folder. The worm tries to copy itself to Windows System folder as <variable string>_update.exe. The worm keeps the the track of infection details in ftplog.txt under root of C: drive. The worm also attempts to remove the registry entries made by W32/Bagle variants.

Microsoft has released a patch for this MS04-011 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on June 10, 2004.

 Other names of W32/Sasser.G:

This worm is also known as Worm.Win32.Sasser.d, W32.Sasser.G.