Sasser variants pose greater danger
Three new versions of the Sasser worm boosted the infectiousness of the original, spreading to about 500,000 computers by Monday, security researchers said. Like the original worm, the three new programs--Sasser.B, Sasser.C and Sasser.D--take advantage of a vulnerability in unpatched versions of Windows XP and Windows 2000 systems. The worms infect vulnerable systems by establishing a remote connection to the targeted computer, installing a File Transfer Protocol (FTP) server and then downloading themselves to the new host.
The original version of the Sasser worm spread slowly, but Saturday, online vandals released Sasser.B, which infected computers much faster. By Monday, two new variants had appeared, and the worm had spread to hundreds of thousands of systems.
"The worm has improved significantly," said Alfred Huger, senior director of Symantec's security response center. Early Monday, Symantec had counted at least 10,000 confirmed infections, and acknowledged that hundreds of thousands of computers have likely been infected.
