Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Sasser.D can run on Windows 95, 98, or ME


  • Please log in to reply
1 reply to this topic

#1 harrywaldron

harrywaldron

    Security Reporter


  • Members
  • 509 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Roanoke, Virginia
  • Local time:11:52 AM

Posted 03 May 2004 - 05:24 PM

Sasser.D can run on but not infect Windows 95, 98, and ME PCs
http://www.sarc.com/avcenter/venc/data/w32.sasser.d.html

W32.Sasser.D.Worm can run on (but not infect) Windows 95/98*Grinler computers. Although these operating systems cannot be infected, they can still be used to infect vulnerable systems that they are able to connect to. Firewall port blocking is the best defense to keep these systems from generating unnecessary network traffic.

BC AdBot (Login to Remove)

 


#2 harrywaldron

harrywaldron

    Security Reporter

  • Topic Starter

  • Members
  • 509 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Roanoke, Virginia
  • Local time:11:52 AM

Posted 05 May 2004 - 08:52 AM

Analysis of Windows 9x and ME impacts

The bottom line is that there are none other than someone copying the actual infected code to a Windows 98 PC and launching it.

Symantec retracted this on the "D" variant as it's now found on the "A", "B", and "C" variants. Other AV vendors aren't reporting this but I've affirmed the potential with McAfee. Thankfully it is a REMOTE and potentially RARE issue. :thumbsup:

While Sasser can run on W/9x as a Win32 process, it must be MANUALLY copied by the user. So far I'm not aware of any automatic injections of the Sasser worm Win32 code as a "process" into W/9x workstations.

This is most likely a minor issue, and the threads here if there is any "Sasser and W/9x impacts" news

http://www.symantec.com/avcenter/venc/data...asser.worm.html
http://www.symantec.com/avcenter/venc/data...ser.b.worm.html
http://www.symantec.com/avcenter/venc/data...ser.c.worm.html

W32.Sasser.C.Worm can run on (but not infect) Windows 95/98*Grinler computers. Although these operating systems cannot be infected, they can still be used to infect vulnerable systems that they are able to connect to. In this case, the worm will waste a lot of resources so that programs cannot run properly, including our removal tool. (On Windows 95/98*Grinler computers, the tool should be run in Safe mode.)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users