Suspected 'Sasser' creator arrested in Germany

MSNBC ^ | Updated: 5:43 a.m. ET May 08, 2004 | AP Staff

[brityank]

Suspected 'Sasser' creator arrested in Germany

Worm infected thousands of computers worldwide

The Associated Press

Updated: 5:43 a.m. ET May  08, 2004

BERLIN - German authorities have arrested an 18-year-old man suspected of creating the "Sasser" computer worm, which infected thousands of computers worldwide, an official said Saturday.

The suspect, a high school student, was arrested Friday, said Frank Federau, a spokesman for the state criminal office in Hanover.

Police and prosecutors on Friday searched his parents' house in the northern town of Waffensen, Federau said. He did not release the man's identity, and said he did not immediately have details of how the suspect was tracked down.

Prosecutors handling the case could not immediately be reached for comment Saturday. German newsweekly Der Spiegel reported, without citing sources, that the CIA and FBI also were involved in the hunt for the worm's creator, whom it identified as Sven J.

~~~~~ snip ~~~~~

Home users were particularly hit hard, computer security experts say, because they generally lack the know-how to install patches and tend not to have the firewalls needed to keep Sasser from spreading to other computers via the Internet.

HOW-TO

Protect yourself against 'Sasser' worm

Concerned your computer is infected? Try these steps:

•

•

•

Enable a firewall to prevent infection or reinfection. The firewall will block Sasser from reaching your computer. It's best to do this before connecting to the Internet. To turn on the WindowsXP firewall, follow the instructions on Microsoft's Web site at http://www.microsoft.com/security/protect/windowsxp/firewall.asp. Enabling the firewall may prevent other software, such as Internet-based gaming, from working correctly. If so, refer to Microsoft's additional instructions.

Download a free "cleaner" program from an antivirus vendor. The program should remove the virus and repair any damage it might have caused. You can also download the program on a friend's computer to a floppy disk, then run it on your computer before connecting to the Internet. Such free programs can be downloaded from McAfee (link: http://vil.nai.com/vil/stinger/), Symantec (link http://securityresponse.symantec.com/avcenter/venc/data/
w32.sasser.removal.tool.html), or several other vendors.

Your computer can still become reinfected unless the appropriate patch is installed. Get the right patch for your PC at http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx. Microsoft recommends a free scan of your PC for any other unpatched vulnerabilities, which is available here: http://specials.msn.com/msn/security.asp?GT1=3391

•

© 2004 The Associated Press. All rights reserved

[gumboyaya]

Throw this little twit on a pile at Abu Ghraid, and good riddance.

[FreedomPoster]

I'm in favor of public floggings for email spammers, and public hangings for virus writers. Though you could convince me on the latter treatment for the former group, in egregious cases.

[blarneystone]

He should be forced to patch 1000000 computers to know what it feels like

[kissmyconservativebutt]

I am a sytems admin and luckily none of my machines were bothered by this particular work. In the past however, I have been forced to work late, weekends, etc. to fix problems that these virus writers think are so damn great.

Give this basta$d to me and I will beat him to a bloody pulp. When I am done, we will heal him up and send him to the next admin.

[mrs. a]

What did George Bush know and when did he know it? I got hit by the Sasser worm and I DEMAND an answer!

[longjack]

The "Spiegel" report said the kid was a middle track student, that is, not in the college entrance program. He confessed immediately when the police showed up.

His mother runs a computer emergency repair business.

longjack

[steveegg]

Give this basta$d to me and I will beat him to a bloody pulp. When I am done, we will heal him up and send him to the next admin.

Just make sure I get him last (or at least not before you).

[governsleastgovernsbest]

I bought a new laptop this week (Averatec 3200 series, about $1,000, like it a lot).

Anyhow, within 10 minutes of setting it up, it got infected with Sasser, and it took me about 30 frustrating minutes to install the patch because it kept on shutting down during the install process.

Serious question: given the untold millions of dollars of damage and lost hours he's caused, what do people think would be a fair punishment? I'd say 10 years.

[FourPeas]

That's actually pretty fast to find the worm writer. I wonder what tipped them off.

[DoctorMichael]

Wire him up to monitors, stick him in a sealed room and keep shutting off the oxygen at random times until he passes out, at which time the oxygen gets turned back on automatically.

A year or two of this ought to evoke a certain level of penance.

[Gorzaloon]

Wire him up to monitors, stick him in a sealed room and keep shutting off the oxygen at random times until he passes out, at which time the oxygen gets turned back on automatically.

I am glad people are no longer thinking this type of crime is "cute", where they hire the writers as security consultants.

Vlad Tepes had some good ideas.

[brityank]

I was told that if you go to Start -- Run -- and put in shutdown -a in WinXP that stops the reboot so you can patch it. My Win2K doesn't have that option, so I struggled getting the cleaner and patch out of my memstick.

Fair punishment? Why foist him on the taxpayers -- chop off both hands.

[brityank]

Give this basta$d to me and I will beat him to a bloody pulp. When I am done, we will heal him up and send him to the next admin.

I'm not an admin; but my systems use Win2K as the gateway to the storage arrays I maintain across three states -- put me on your list, I always wanted to try amputation.

[Eric in the Ozarks]

A two year does of prison should do the trick. May I suggest a steel cage in Fort Madison, IA ?

[governsleastgovernsbest]

Interesting tip about shutdown - a. Wish I had known that while I was struggling to download the patch. I felt like I was in one of those thriller movies with the red electronic displays ticking down the seconds till the explosion.

As you know, Sasser causes a window to pop up saying that the computer will shut down, and gives a countdown to shutdown in seconds. I was sitting there literally screaming at my computer to finish the darn download before it shut down!

[marshmallow]

These kids have the same mindset as vandals. They derive pleasure from breaking stuff and causing inconvenience to people. Instead of busting up subway cars, bus shelters and school property they do it in cyberspace.

[GaltMeister]

If you see it again, hit ctrl+alt+delete to get task manager. Click on processes, and look for AVSERVE2.EXE on the list. That is the virus; kill that process and you should be able to DL & patch the system.

[night reader]

Serious question: given the untold millions of dollars of damage and lost hours he's caused, what do people think would be a fair punishment? I'd say 10 years.

In all seriousness, how about a class action law suit? Even if each plaintiff got only five or ten dollars, he'd be working the rest of his life to pay it off. In this event, could he be prevented from declaring bankruptcy and just walking away? This civil suit, of course, would be in addition to any criminal prosecution.

[eleni121]

Yup ten years at hard labor fixing people's computers for free.