The University of Denver was hit with Sasser, a new Internet-based worm, last week, leaving many students without working computers and University Technology Services technicians swamped with work.
Ken Stafford, vice chancellor for UTS, said that approximately 400 students were hit with the worm.
Lesley Beckman, a junior whose laptop got the worm, said, “The virus is really irritating. Particularly since I got it twice, removed it twice and there are still remnants of it on my computer I can’t get rid of, which means I can’t get online.”
Charmaine Robledo, a senior, said she spent six hours at the UTS help desk in Penrose Library while UTS technicians fixed her computer.
“They couldn’t find the worm and aren’t sure where it is,” she said. She was advised that if it came back she should return to UTS.
Max Goldberg praised UTS for their help when he discovered he had the worm.
“The people in UTS were great,” he said. He spent 30 minutes getting his laptop repaired.
Stafford said the worm entered the DU network through an infected laptop that an unknown student plugged into the network.
Sasser, widely released worldwide at the end of last month, has taken control of several student computers across campus. This is the latest in a series of worms infecting the Windows 2000 and XP versions since last August, when the Blaster worm hit the campus’ computers.
The symptoms of the worm range from sluggish performance by infected computers to random shutdowns or reboots, depending on the variant of the worm present on the computer, labeled A,B,C and D.
This worm spreads by taking advantage of a Microsoft Windows vulnerability called Local Security Authority Subsystem Service (LSASS, hence the worm name Sasser). The Sasser worm searches random Internet protocol addresses (these are numeric addresses by which your computer is identified to the campus network), until a computer where the vulnerability is present is found. When such a computer is found, the worm downloads itself into a specific location on the computer’s hard disk drive. Such searching by the worm also causes network slowdowns.
The difference between this worm and a virus is that the latter has to be initiated by the user by opening an e-mail, program, etc., while the worm infects a computer only because it is part of an infected network.
If your computer is infected, a copy of the Sasser fix tool can also be downloaded for free at http://www.symantec.com. But it is important to install all critical updates and patches immediately after the scan to prevent receiving the virus again.
Stafford said UTS will be looking into stricter controls for next year to prevent infected computers from logging into the network. He said they are still working out the technical details.
He strongly recommended that students regularly update Windows on their computer as a preventative measure.
START INFO BOX
Run Windows Update
Run updates to download the latest definitions for your anti-virus and scan your computer often.
If you are having any problems, contact Resident Technology Assistants or contact the UTS Helpdesk at x14700 or at support@du.edu.
Be careful about what e-mails you open as many viruses and worms are spread through e-mail address books.
