Experts weigh Sasser - Netsky worm connection

An author's message buried in the Netsky-K worm promised to be "the last version," after which the author would publish the worm's code on the Internet. Many more variants followed that release and the code is believed to be widely available within virus writing circles, meaning that Sasser could be the work of anybody with access to that code. The exploit code for the LSASS vulnerability was also circulated widely on the Internet in the days preceding Sasser's release, he said.

"I think that they just saw the (LSASS) exploit out there and saw that it worked pretty well, so they borrowed elements of the code already written for Netsky and threw together (Sasser) in a short time frame," he said.

However, Internet worms like Sasser have a shorter window of time in which to spread than e-mail worms, which can continue to thrive as long as they find new ways to trick e-mail users. Despite the release of new variants, the rate of new Sasser infections was falling Monday. The number of infected machines also appeared to be dropping, according to LURHQ statistics, Stewart said.

The decreases were most likely due to Internet users heeding warnings about Sasser and patching vulnerable Windows systems or blocking the ports that Sasser uses to spread, he said.