Sasser Virus

ColmOT [MSFT]

Hi All, just a quick note to let you know that the new Sasser virus is on the loose.

Microsoft released a patch on April 13th to deal with this virus.

It can be downloaded from here http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

It's recommended that you install this patch ASAP to protect your systems.

You can go to www.microsoft.com/security/incident/sasser.asp to scan your machine to see if you're infected.

Hope this helps,

Colm.

seamus

Nightmare......
It's horrible when everyone comes in and things are generally crawling along and giving trouble.

It's even more horrible when I have to support them

Ste-

Originally posted by seamus
It's even more horrible when I have to support them

I agree, God help those people.
Thanks for the links ColmOT [MSFT] I know a few people that will get this damn newbs.

Stephen

If only they'd install a bloody firewall

aidan_dunne

Tell me about it. You wouldn't believe (actually, you probably will because you've all gone through this scenario too yourselves, I bet) the amount of times I've had to deal with someone who's gotten a virus like Blaster or whatever and then I've tried explaining to them the importance of using a firewall, keeping Windows patched and updated and keeping their anti-virus software up to date. And what do they then say to me? "Ah sure, why do I need any of that stuff? I hardly use the computer at all and I only go on the internet once every couple of weeks. And sure that's only for about half an hour anyway, to check my e-mails and stuff. Sure that's not going to do any harm to me." You then try to explain to them that, yes, even a couple of minutes online without a firewall, a patched and updated version of Windows and no anti-virus software means you are 99% certain to catch some kind of virus. "Right, sure, I'll do all that, so."

Then, two weeks later you get a phone call from them to find they've only gone and gotten re-infected again or have caught something else because.......... they never actually went and did what you told them to do! "Sure, you only fixed the computer a couple of weeks ago. It couldn't be broken again. Are you sure you fixed it properly the last time?" Yes! Yes I f**king did. It's you who keeps f**king it up because you won't have a bit of common sense! And, so, you have to go out and fix things for them again, give them the same lecture again, knowing in your heart of hearts it's only going to fall on deaf-ears again.

Christ, even when you actually install firewalls, anti-virus software and all the latest patches for them they still refuse to update the damn things. I mean, how many times do you have to tell someone to update their anti-virus software at least every couple of weeks and make sure they always get the latest patches before it finally gets through to them? It's not difficult, it doesn't take all that long so why can't you do it yourselves instead of calling me out to do it all the time? Jaysus, sure I've even shown you how to go about doing it. What more do you want, for me to hold your bloody hand on the mouse for you? Would you like me to to wipe your f**king arse for you after a sh!te as well while I'm at it? :mad:

Honestly, sometimes I swear that some people shouldn't be even let near a computer, let alone actually own one! :mad:





Okay, rant over!

TomTom

Tell me about it, I'm working in symantec and its a bloody nightmare. A lot of people seem to think its my fault personaly that they have the virus. Tossers.

Gillo

I'll poss get banned for it.

But Ha Ha, my Mac is running great at the mo, pity though cos I always miss the excitment when a new virus, worm, torjon horse or STD comes out for windows.

ando

i have a great time when a new virus comes out... we're in da money !

D

Did anyone else hear the rumour about it was a fledglying Russian Anti-Virus company that started the sasser and then paraded in offering a fix for it?

po0k

Originally posted by aidan_dunne
Then, two weeks later you get a phone call from them to find they've only gone and gotten re-infected again or have caught something else because.......... they never actually went and did what you told them to do!

/me hears the sweet sound of "cha-ching"

Cabaal

Originally posted by seamus
Nightmare......
It's horrible when everyone comes in and things are generally crawling along and giving trouble.

It's even more horrible when I have to support them

I don't even have to do that
Loads of people ringing work with it
If there lucky I'll do shutdown -a and give em ms site
otherwise VENDORRR!!!

Cabaal

Originally posted by SyxPak
/me hears the sweet sound of "cha-ching"

In Other news:
RTE News is reporting that Compustore have reported 1.5BEUR in profits this year

Originally posted by gillo
But Ha Ha, my Mac is running great at the mo, pity though cos I always miss the excitment when a new virus, worm, torjon horse or STD comes out for windows.

All those Linux users feel the exact same

leeroybrown

Theres nothing like having to schedule downtime for all your production windows servers in one afternoon to get an IT support group running around the place looking worried.

begbie

Is this the virus thats on the news and in the papers that targets people who don't have a firewall? And that infects your computer just by going on the net?

I have windows 98, will that security patch work for that? :dunno:

leonotron

wow thats terrible that you have to do your job. I feel really sorry for you

Originally posted by aidan_dunne
Tell me about it. You wouldn't believe (actually, you probably will because you've all gone through this scenario too yourselves, I bet) the amount of times I've had to deal with someone who's gotten a virus like Blaster or whatever and then I've tried explaining to them the importance of using a firewall, keeping Windows patched and updated and keeping their anti-virus software up to date. And what do they then say to me? "Ah sure, why do I need any of that stuff? I hardly use the computer at all and I only go on the internet once every couple of weeks. And sure that's only for about half an hour anyway, to check my e-mails and stuff. Sure that's not going to do any harm to me." You then try to explain to them that, yes, even a couple of minutes online without a firewall, a patched and updated version of Windows and no anti-virus software means you are 99% certain to catch some kind of virus. "Right, sure, I'll do all that, so."

Then, two weeks later you get a phone call from them to find they've only gone and gotten re-infected again or have caught something else because.......... they never actually went and did what you told them to do! "Sure, you only fixed the computer a couple of weeks ago. It couldn't be broken again. Are you sure you fixed it properly the last time?" Yes! Yes I f**king did. It's you who keeps f**king it up because you won't have a bit of common sense! And, so, you have to go out and fix things for them again, give them the same lecture again, knowing in your heart of hearts it's only going to fall on deaf-ears again.

Christ, even when you actually install firewalls, anti-virus software and all the latest patches for them they still refuse to update the damn things. I mean, how many times do you have to tell someone to update their anti-virus software at least every couple of weeks and make sure they always get the latest patches before it finally gets through to them? It's not difficult, it doesn't take all that long so why can't you do it yourselves instead of calling me out to do it all the time? Jaysus, sure I've even shown you how to go about doing it. What more do you want, for me to hold your bloody hand on the mouse for you? Would you like me to to wipe your f**king arse for you after a sh!te as well while I'm at it? :mad:

Honestly, sometimes I swear that some people shouldn't be even let near a computer, let alone actually own one! :mad:





Okay, rant over!

Ronan|Raven

Originally posted by begbie
Is this the virus thats on the news and in the papers that targets people who don't have a firewall? And that infects your computer just by going on the net?

I have windows 98, will that security patch work for that? :dunno:

Your safe on windows 98. Dont need to worry about this perticular problem.

seamus

Originally posted by begbie
Is this the virus thats on the news and in the papers that targets people who don't have a firewall? And that infects your computer just by going on the net?

I have windows 98, will that security patch work for that? :dunno:

You won't be affected because your OS is ultra-shit™.

ColmOT [MSFT]

Gillo, this is probably a case of 'the pot calling the kettle black', but Apple OSs aren't without vulnerabilities either...

http://docs.info.apple.com/article.html?artnum=61798

'let he who has not sinned case the first stone'!

Stephen

it doesn't "target" those without firewalls, its just that firewalls are generally configured to block the ports that the virus uses, thus its having no effect on machines behind such firewalls.

ando

Originally posted by seamus
You won't be affected because your OS is ultra-shit™.

ROFL !!! that made my day, whats left of it anyway

seamus

The patches we've been rolling out are causing more hassle than the worm itself.

IE5.5 has suddenly decided to stop working, so we have to do a rollout of IE6. My head is melted.... :dunno:

ColmOT [MSFT]

Seamus, what patch did you roll out to cause 5.5 to stop working?

Cabaal

Originally posted by seamus
IE5.5 has suddenly decided to stop working, so we have to do a rollout of IE6. My head is melted.... :dunno:

Sigh..bloody IE
I've given up using in altogether at work now
Only reason I use IE now is for winupdates

Emboss

Originally posted by ColmOT [MSFT]
Gillo, this is probably a case of 'the pot calling the kettle black', but Apple OSs aren't without vulnerabilities either...

http://docs.info.apple.com/article.html?artnum=61798

'let he who has not sinned case the first stone'!

Why do you always do that?

there's a handfull of fixes there over TWO years for 9 and OS X and the majority of the fixes are for 3rd party software and not the base OS.

please stop doing this everytime a windows worm/virus/security vun is announced.

Cabaal

Originally posted by Emboss
Why do you always do that?
there's a handfull of fixes there over TWO years for 9 and OS X and the majority of the fixes are for 3rd party software and not the base OS.

Agreed, abit stupid to post such old and inacturate info here
Alot of the *patches* are just issued to fix crashing issues (ie: quicktime) or improve performence with applications within OSX, these are NOTHING compared to the security issues with Win9x/NT/XP

seamus

Originally posted by ColmOT [MSFT]
Seamus, what patch did you roll out to cause 5.5 to stop working?

No idea, they decided Tuesday morning would be a good time to roll out 12 patches concurrently. After that, it all went pear shaped.

Should have upgraded to IE6 long ago, but now we have to so....

ColmOT [MSFT]

Ok. Just as an FYI, all patches are tested on the various flavours of IE from IE 5.0 up to IE 6 SP1.

If there was an issue with a patch, it _should_ have been caught.

If it happens again let me know and I'll try to find out more info for you.

Cheers,

Colm.

begbie

Originally posted by Ronan|Raven
Your safe on windows 98. Dont need to worry about this perticular problem.

Awesome.

Cake Fiend

Originally posted by ColmOT [MSFT]
Blah blah, pathetic clutching-at-straws put-down of MacOS...

Are you aware how sad and brainwashed you look when you do something like this? I thought you'd have learnt your lesson on the Unix forum.

Originally posted by TomTom
Tell me about it, I'm working in symantec and its a bloody nightmare. A lot of people seem to think its my fault personaly that they have the virus. Tossers.

I hate these ****. They don't even realize that they're the very reason that worms like these are so widespread, every infected machine in turn infecting dozens of others. The worst kind of fu<king morons I deal with.

I hope MS turn on automatic updating by default with XP SP2 as well as the firewall. Idiots need to be protected from themselves (and the rest of us need to be protected from these idiots).

ColmOT [MSFT]

AU & Firewall are turned on by default in XP SP2, as is a popup-blocker.

And to your other comment...I'm not brainwashed, I just understand software development and the fact that Windows isn't the only OS with bugs. Someone else is allowed to post a 'tongue-in-cheek' comment, and I can't? Where is your reasoning to this?

RicardoSmith

The reason MS gets hit so often with virus'es is because its the most popular and its the most popular because its an easy system to develop, which also makes it the easiest to develop virus for. So its a bit like complaining a square has sharp edges and why can't it be more like a circle. Also most software works on a 286 to Xeon. So again it just makes it an easy target.

Whats the Mac market share now 1.7%? Nice Machines and all that but why would someone even bother writing a virus for it? Most people don't even write legal software for it.

egan007

Originally posted by ColmOT [MSFT]
Gillo, this is probably a case of 'the pot calling the kettle black', but Apple OSs aren't without vulnerabilities either...

http://docs.info.apple.com/article.html?artnum=61798

'let he who has not sinned case the first stone'!

I work on solaris
*throws stone*

ColmOT [MSFT]

hehe - yeah - Solaris is nice....I've got it at home as well...

*catches stone - saves it for later*

smoke.me.a.kipper

Originally posted by Cabaal
I don't even have to do that
Loads of people ringing work with it
If there lucky I'll do shutdown -a and give em ms site
otherwise VENDORRR!!!

music to my ears when someone says there pc keeps shutting down. btw, i think vendor is fast becoming my favourite word!

Cake Fiend

Originally posted by RicardoSmith
The reason MS gets hit so often with virus'es is because its the most popular and its the most popular because its an easy system to develop, which also makes it the easiest to develop virus for.

Right, so it's got nothing to do with the inherent insecurity of MS operating systems then? If Linux were to become as popular as Windows XP, do you believe there would be as many successful viral attacks against it?

Oh dear, we're getting awfully off-topic here.

seamus

Originally posted by Sico
Right, so it's got nothing to do with the inherent insecurity of MS operating systems then? If Linux were to become as popular as Windows XP, do you believe there would be as many successful viral attacks against it?

Oh dear, we're getting awfully off-topic here.

Who's to say Sico, that if Linux were a privately-developed OS, owned by a monopolistic company, that there wouldn't be as many successful attacks on it?

We may never know.

ando

Originally posted by seamus
The patches we've been rolling out are causing more hassle than the worm itself.

I applied that ms patch today on about 30 pcs, 2 of them didnt come back up... and just my luck one of them was the MD's

RicardoSmith

Originally posted by Sico
Right, so it's got nothing to do with the inherent insecurity of MS operating systems then? If Linux were to become as popular as Windows XP, do you believe there would be as many successful viral attacks against it?

Oh dear, we're getting awfully off-topic here.

Your comparing a square against an circle. Different beasts with different problems.

RicardoSmith

Originally posted by ando
I applied that ms patch today on about 30 pcs, 2 of them didnt come back up... and just my luck one of them was the MD's

Isn't that always the way

Jorinn

Originally posted by ColmOT [MSFT]
AU & Firewall are turned on by default in XP SP2, as is a popup-blocker.

And to your other comment...I'm not brainwashed, I just understand software development and the fact that Windows isn't the only OS with bugs. Someone else is allowed to post a 'tongue-in-cheek' comment, and I can't? Where is your reasoning to this?

You should get yourself a commercial interaction forum.

Cake Fiend

Originally posted by RicardoSmith
Your comparing a square against an circle. Different beasts with different problems.

Eh? Not sure what that's supposed to mean. If MS had put in the effort, they could have made XP a more secure OS, without sacrificing its ease of development. They didn't. Linux works in a far more secure fashion out of the box, even as a desktop OS. I don't see the problem in comparing these two operating systems, aside from the fact that Windows is currently more widespread among desktop users than Linux.

Originally posted by ColmOT [MSFT]
Someone else is allowed to post a 'tongue-in-cheek' comment, and I can't? Where is your reasoning to this?

Fair enough, I jumped the gun on this one a bit (I have a lack of patience for MS fanboys). But it does grate when someone compares a mountain of MS patches to a molehill of Apple updates. It just smacked a bit of a desperate ditch to change the focus of attention. As Emboss posted:

there's a handfull of fixes there over TWO years for 9 and OS X and the majority of the fixes are for 3rd party software and not the base OS.

Colm, any chance of a figure for the number of critical and/or security updates that have been released so far for XP?

RicardoSmith

Does linux have dll's, com, ocx, ActiveX, VBA, VB, .net etc. Does it even have anything similar? Does i have anything like VBA or Office from a Development point of view? No. Thats fundamental to understanding how different these OS are.

You're only focusing on it from the end user experience. Thats the tip of a large iceberg.

Emboss

Colm, any chance of a figure for the number of critical and/or security updates that have been released so far for XP?

hehehe

While you're at it, check and see how good MS's own staff are at applying these patches.

get the stats for the amount of ports shut down by netsec since slammer......

I could do with a laugh

leeroybrown

I'm not a Microsoft fan but in fairness to them their security is slowly improving over time, mainly due to a major requirement from their big customers for it.

Still, the big gripes I have with Microsoft security are:

- A large percentage of problems are remotely exploitable (Blaster and Sasser being examples)
- When exploited these problems generally expose the entire OS, filesystem and all applications on it to the attacker.
- Most of these problems require a reboot to complete the reinstallation.

I average a minimum of one security related reboot a week on my XP desktop at work (which doesn't have many exploitable apps/servers installed).

Conversely, I'm involved in administering some Linux (debian) servers with large user bases and a lot of server processes running. These have required ~5 security related reboots in the past 12 months. None of these were directly remotely exploitable either.

Every other update could be done live with a ~5 second downtime on individual server processes to restart daemons with the patched code in place. For example, the most recent update required was for the 'exim' mailserver which is a package specific patch in the same way Exchange patches would be.

Originally posted by leeroybrown
Theres nothing like having to schedule downtime for all your production windows servers in one afternoon to get an IT support group running around the place looking worried.

I shouldn't have tempted fate. Talking to a colleague who was involved in the patching roll out, it appears that a couple of the first batch (production servers) to be done failed to boot up after the post patch reboot and patching the rest was consequently postponed.

D

Apparently some german teenager has been arrested and charged for the creation of the sasser

kaimera

yip. a german teen caught and questioned for about the sasser.

speaking of which, thank frick I got my Norton updates fairly rapidly becos it has caught and deleted sasser 5 times and counting since I've been online in the last 15 mins

secret_squirrel

Originally posted by Kaimera
speaking of which, thank frick I got my Norton updates fairly rapidly becos it has caught and deleted sasser 5 times and counting since I've been online in the last 15 mins

Then maybe you should get a software firewall? Or atleast turn on the one build into winxp if you're using XP.

Nick_oliveri

Anyone know how to scan the automatic updates that have been downloaded and not installed? I keep putting it off for three days cus it keeps downloading the same stupid sh!t. Dont want sasser or any other little fockers coming through microsoft. Because i can see it happening.

Turner

I use Sygate personal firewall....

Seems to have worked for me.

bus77

I use win98.
Im untouchable me:D

Jorinn

Originally posted by RicardoSmith
Does linux have dll's, com, ocx, ActiveX, VBA, VB, .net etc. Does it even have anything similar? Does i have anything like VBA or Office from a Development point of view? No. Thats fundamental to understanding how different these OS are.

You're only focusing on it from the end user experience. Thats the tip of a large iceberg.

[cynical]No it doesn't have as much inherent vulnerabilities[/cynical] Dunno about the rest but there is a .net equivelent called mono it think.