sasser.exe

What is sasser.exe?

sasser.exe is the main executable used by the Sasser worm, a Windows network worm that infected Windows XP and Windows 2000 systems in the mid-2000s. It propagates by scanning for vulnerable hosts, exploiting a bug in LSASS to copy itself to remote machines, dropping payloads in System32 and triggering reboots to advance the infection.

Exploits a LSASS vulnerability to gain remote code execution and propagate via the network, using components like avserve.exe and avserve2.exe to drop and run payloads on new hosts.

Types of Sasser Processes

• Main Worm Process: Orchestrates propagation and control of the infection.
• Scanner Engine: Network scanning component that searches for vulnerable hosts.
• Payload Dropper: Copies and deploys the payload on newly infected hosts.
• Replication Manager: Manages copies like avserve.exe/avserve2.exe during propagation.
• Reboot Controller: Triggers system reboot to complete infection on target machines.
• Cleanup/Stealth: Attempts to minimize visible traces while propagating.

Is sasser.exe Safe?

No, sasser.exe is not safe as it is the executable for a worm that spreads across Windows networks.

Is sasser.exe a Virus or Malware?

The real sasser.exe is malware (a worm). However, malware sometimes disguises itself with similar names.

How to Tell if sasser.exe is Legitimate or Malware

1. File Location:: Check for sasser.exe in C:\Windows\System32\sasser.exe or C:\Windows\System32\avserve.exe. Any sasser.exe outside these folders is suspicious.
2. Digital Signature:: Right-click C:\Windows\System32\sasser.exe → Properties → Digital Signatures. Should not show a trustworthy Microsoft signature.
3. Resource Usage:: Unexplained CPU spikes or prolonged high usage during idle times is a red flag for malware.
4. Behavior:: Should not appear as a regular user process; look for abnormal network activity and reboot triggers.

Why Is sasser.exe Running on My PC?

sasser.exe runs to propagate itself across networks and maintain control over infected hosts. It can start automatically and consume resources while scanning and spreading.

Reasons it's running:

• Active Network Propagation: The worm actively scans nearby hosts to locate additional victims and copy itself to those machines.
• LSASS Exploit Use: It exploits a Local Security Authority sub-system vulnerability to gain remote execution on other Windows systems.
• Startup or Background Execution: Variants may attempt to run on startup or continue running in the background to sustain the infection.
• Automatic Reboots: Infection often triggers reboots to finalize installation and reduce user interaction during propagation.
• Low User Interaction: The worm is designed to operate with minimal user action, relying on automated network spread.

Can I Disable or Remove sasser.exe?

Yes, you can disable and remove sasser.exe, but only after disinfection. Isolating the machine, applying patches, and cleaning all infected files is required.

How to Stop sasser.exe

• Disconnect Network: Unplug Ethernet, disable Wi‑Fi, and switch the machine to offline mode to halt propagation.
• Run Antivirus: Update definitions and perform a full system scan; quarantine or delete any sasser-related files (sasser.exe, avserve.exe, avserve2.exe).
• Stop Startup Entries: Check C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup for suspicious shortcuts named sasser.* and remove them.
• Patch and Reboot: Apply all Windows security updates related to LSASS vulnerabilities and reboot after disinfecting.
• Network Cleanup: Scan the network for other infected hosts and isolate them until remediation steps are applied.

Common Problems: Infection Symptoms and Remedies

If a machine is infected with Sasser, you may see rapid network activity, unexpected reboots, and high CPU/memory usage during propagation attempts.

Common Causes & Solutions

• Rapid network scanning: Block outgoing connections on vulnerable ports (445/139) with a firewall; run a full antivirus scan.
• Malicious startup entries: Remove sasser-related startup items from Startup folders and registry keys; check startup programs and scheduled tasks.
• Outdated Windows: Patch Windows with the latest security updates and disable LSASS-related vulnerabilities for non-critical systems.
• Unknown or corrupted AV signatures: Update antivirus to latest definitions and run offline scans from rescue media if needed.
• Misleading benign processes: Verify processes in Task Manager; compare file paths to C:\Windows\System32 and look for avserve*.exe variants.
• Multiple reinfections: Isolate entire subnet, disinfect each host, and re-segment network until all hosts are clean.

Related Processes