Malicious attackers seek to exploit unprotected computer systems

Microsoft is actively analysing and providing guidance on a worm identified as the W32.Sasser.worm (Sasser). This is as a result of a recent increase in malicious activity on the Internet, including the development of attack tools and exploit code. Through this worm, the attacker is initiating an automated attack against computer users and is attempting to exploit systems that are not protected against the Local Security Authority Subsystem Service (LSASS) vulnerability.

This vulnerability is mitigated by the use of a firewall and fixed in Microsoft Security Update MS04-011 on 13 April 2004. There is additional malicious activity in the form of variants of a worm known as "Agobot" (or "Agrobot"), which similarly seeks to exploit systems not protected by a firewall or the installation of MS04-011.

Tens of millions of customers who have followed the steps on www.microsoft.com/protect to enable Automatic Updates should already be protected against these emerging threats, as they should have received MS04-011 automatically.

Customers who have been infected with the W32.Sasser.worm may experience difficulty accessing the Internet. Infected customers may also receive a LSASS.exe error pop-up which may cause a reboot. To assist customers, Microsoft has made available at no-cost, a software-based cleaning tool available that customers can use to automatically remove the Sasser worm from infected PCs after deploying the security update. The tool is available at www.microsoft.com/security.

Customers who are still experiencing infection symptoms may be infected with a different threat and should update their anti-virus signatures. Additional guidance is available from Microsoft`s call centre on 086 0225567.

Microsoft is working closely with the anti-virus community, ISPs and other industry partners to help protect customers. Customers using a firewall, including the firewall in Windows XP, as well as third-party hardware or software firewalls are generally protected against Sasser and Agobot threats. Customers can protect against these attacks by first ensuring that their firewall is in place, and then installing Microsoft Security update MS04-011 immediately. The MS04-011 security bulletin is available as a free download at www.microsoft.com./technet/security/bulletin/ms04-011.mspx or users can use Windows Update to access the latest security update.

Microsoft continues to recommend that all customers visit www.microsoft.com/protect to take three key steps to protect their PCs. These include:

* Use an Internet firewall on all PCs and laptops: An Internet firewall can help prevent outsiders from getting to your computer through the Internet. If you use Microsoft Windows XP, enable the built-in firewall.

* Update your computer: Windows includes the automatic updates feature (Windows Update) which can automatically download the latest Microsoft security updates. Windows 98 SE and Windows ME can be updated from windowsupdate.microsoft.com.

* Use up-to-date anti-virus software: Installing, configuring and maintaining anti-virus protection is absolutely essential.

In addition, Microsoft Corporation is working closely with law enforcement authorities, including the Northwest CyberCrime Taskforce, a joint effort between the FBI and US Secret Service, to forensically analyse the malicious code in Sasser and Agobot, to identify and bring to justice those responsible for this malicious activity. The investigation is ongoing, and questions about the investigation should be referred to the Northwest CyberCrime Taskforce.

New information will be posted to http://www.microsoft.com/security as it becomes available. For local comment on the issue, please contact Lisa Clark on 011 257 0465.