MS04-011-Based Sassy New Worm (Low Risk)

The First MS04-011 Worm Family, Sasser, Low Risk

McAfee has posted a write-up for the first version of a new line of worms, W32/Sasser.worm. This worm spreads using the name avserve.exe. The MS04-011 vulnerability is used in order to spread. This is the first individual family to use this feature (variants of the large W32/Gaobot.worm family were the first worms period) but it does not appear that it is very successful. Subsequent versions, however, could be dangerous. Users should remain vigilant and apply the appropriate patches. This worm spreads on TCP port 5554.

McAfee Description
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=125007