Sasser's heirs spread slowly
A double-edged threat that attempts to hijack Windows PCs has surfaced in at least three variants, security companies warned on Friday.
The new pest, Lebreat, is a combined network worm and mass-mailing worm, F-Secure said. Once run on a PC, it installs a backdoor for hackers, downloads the mass-mailer code and attempts to launch a DoS attack that targets security giant Symantec's Web site, the Finnish antivirus specialist said. The malicious code is also known as Breatle and Reatle at other antivirus companies.
"This virus claims to be 'Breatle AntiVirus v1.0', and it spreads over both email and network vulnerabilities," F-Secure said in its advisory.
The network-worm part of Lebreat exploits a known Windows flaw in a component called the Local Security Authority Subsystem Service (LSASS), the security company said. The LSASS vulnerability was also used by the Sasser worm, F-Secure said in its advisory. Microsoft issued a patch for the LSASS flaw last year.
Lebreat is also a mass-mailer, which means it travels as an attachment in an email message.
