The Sasser worm

October 2016

Introduction to the Sasser virus

Appearing in May 2004, the Sasser virus (also known as the W32/Sasser.worm, W32.Sasser.Worm, Worm.Win32.Sasser.a, Worm.Win32.Sasser.b or Win32.Sasser) is a virus which exploits a security hole in the LSASS (Local Security Authority Subsystem Service, which corresponds to the executable file lsass.exe) in Windows. The appearance of the first virus to exploit the security hole in Windows' LSASS service occurred barely two weeks after the hole was publicised and the first patches for it were released. Windows NT 4.0, 2000, XP and (to a lesser degree) Windows Server 2003 are all affected.

What the virus does

The Sasser virus is programmed to launch 128 processes (1024 for the SasserC variant) which scan a range of random IP addresses looking for systems vulnerable to the LSASS hole on port 445/TCP.

The virus installs an FTP server on port 5554 so that it can be downloaded by other infected computers.

Then, when a vulnerable machine is found, the worm opens a remote shell on the machine (on TCP port 9996), and makes the remote machine download a copy of the worm (named avserve.exe or avserve2.exe for the Sasser.B variant) in the Windows directory.

Once the file has been downloaded, it creates a file named win.log (or win2.log for the Sasser.B variant) in the c:\ directory in order to record how many machines it was able to infect. Then it creates entries in the registry so that it will restart every time the computer is rebooted:

  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run\avserve = avserve.exe
    avserve.exe -> C:\%WINDIR%\avserve.exe

The virus runs "AbortSystemShutdown" to prevent the user or other viruses from rebooting (and from deactivating it).

Symptoms of infection

Exploiting the LSASS vulnerability causes some malfunctions on affected computers, related to shutting down the LSASS service (process lsass.exe). Vulnerable systems have the following symptoms:

  • Unwanted restarts, with the system displaying the message:
    System shutdown initiated by Authority/System
    The system process: C:\WINDOWS\system32\lsass.exe
    terminated unexpectedly with status code 128.
  • Network traffic on TCP ports 445, 5554 and 9996,
  • Sudden shutdown of 'LSASS.EXE' with an error message saying:
    lsass.exe - application error

Eradicating the virus

To eradicate the Sasser worm, the best method involves first protecting the system by activating the firewall. In Windows XP, go to

Start menu > Settings > Control panel > Network connections
Then right-click on the Internet connection, and from there click on Properties. Select the tab "Advanced settings", then check the box "Protect my computer and the network by limiting or preventing access to this computer from the Internet," and apply it by clicking OK.

You should then update the system, either by using Windows Update or by downloading and installing whichever patch is right for your operating system:

Finally, you can clean up the system by using the virus removal kit:
Download the virus removal kit

What's more, since the virus spreads using Microsoft Windows networking, it is strongly recommended to install a personal firewall on your machines which are connected to the Internet, and also to filter ports TCP/445, TCP/5554 and TCP/9996.

More information about the virus

Related :

El gusano Sasser
El gusano Sasser
Le ver Sasser
Le ver Sasser
Le ver Sasser
Le ver Sasser
Lo worm Sasser
Lo worm Sasser
O verme Sasser
O verme Sasser
This document entitled « The Sasser worm » from CCM ( is made available under the Creative Commons license. You can copy, modify copies of this page, under the conditions stipulated by the license, as this note appears clearly.