We've seen worse than Sasser - MS
Microsoft is considering automating the process of cleaning up systems infected by the Sasser worm, which spread like wildfire across the Internet over the weekend.
The software giant has already released a cleaning tool that can be downloaded manually. Microsoft may put this into automatic updates, depending on the "level of infection and feedback from ISPs," Stuart Okin, Chief Security Officer at Microsoft UK, told El Reg.
The idea is the same as with a Blaster clean-up tool released in January: create a utility to clean PCs that are have been patched against the vulnerability it exploited, but are still infected with the worm. Microsoft now has the systems in place to roll out the disinfection much more quickly this time, if necessary. A decision depends on the extent of tSasser's scanning activity.
Sasser is a network aware worm that exploits a recently announced Microsoft vulnerability (in Windows Local Security Authority Subsystem Service Microsoft vulnerability - MS04-011). The worm, and its three variants - so far - spreads by scanning randomly chosen IP addresses for unpatched systems to infect. A patch was released last month.
