[kall]

A new Internet computer worm has infected millions of computers causing major disruptions over the weekend.

Computer security experts have warned that the virus may spread rapidly when businesses resume work on Monday morning.

Named Sasser, the worm, began to spread on Saturday, and unlike a virus does not travel through e-mails or attachments.

It can spread by itself to any unprotected computer linked to the Internet.

The virus attacks through a flaw in recent versions of Microsoft's Windows — Windows 2000, Windows Server 2003 and Windows XP — and causes the computer to shut down, then rebooting it, repeating the process several times.

[kall]

Click here (mcafee site) for info on removal.

From the same site:

Method of Infection

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host accepts this FTP traffic on TCP port 5554.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445

Here's the updater for Norton...

http://securityresponse.symantec.com...03-022-i32.exe

It's for the following versions:

NAV 2000 for Win9x/NT/2000
NAV 2001 for Win95b/98/NT/2000/Me
NAV 2002 Professional Edition
NAV 2002 for Win98/Me/NT/2000/XP Home/XP Pro
NAV 2003 Professional Edition
NAV 2003 for Win98/Me/2000/XP Home/XP Pro
NAV 2004 Professional Edition
NAV 2004 for Win98/Me/2000/XP Home/XP Pro
NAV 7.x Corporate Edition Client
NAV for Lotus Notes (Intel)
NAV for MS Exchange (Intel)
Norton SystemWorks (all versions)
Norton Utilities for Windows 95/98 (all versions)
SAV 3.0 CacheFlow Security Gateway
SAV 3.0 for Inktomi Traffic Edge
SAV 3.0 for NetApp Filer/NetCache
SAV 3.1 for SMTP Gateways for Windows
SAV 8.0 Corporate Edition Client
SAV 8.1 Corporate Edition Client
SAV 9.0 Corporate Edition Client
SAV/Filtering 3.02 for MS Exchange 2000
SAV/Filtering 3.1 for Domino
pcAnywhere32 7.5 and higher for WinNT

and here is Norton's Removal tool if you know you have it:

http://securityresponse.symantec.com...oval.tool.html

[kall]

and apparently some little company called miscrosoft has fixes for it at www.microsoft.com/support.