Now somebody has had a chance to play with it.' It's been out for more than a week and made the rounds of whatever computing underground was connected to. 'It makes sense that this is a variant of the source code.

That would make sense, if the author released the Sasser source code with the initial worm, then made modifications to it himself, Hinojosa said.

The new Sasser version doesn't disprove the lone-author idea, but it suggests that the Sasser worm source code has been released on the Internet, said Patrick Hinojosa, chief technology officer at Panda Software U.S.Īn analysis of the Sasser-F worm's code revealed that it's an offshoot of the original worm, Sasser-A, that doesn't include any of the changes or improvements to the worm introduced in previous variants, he said. However, the investigation continues, and other arrests in the case are possible, he said. Smith cited German police reports of 'overwhelming' evidence that Jaschan created the worm and the young man's confession as proof of his link to the first five versions of the worm. What it will mean is that somebody else is up to something else as well,' he said. 'A new variant won't change our thinking about variants A through E. Experts also said changes in the Netsky worm family over time and messages in both worms pointed to a group of virus writers, not a lone author.Īsked yesterday about the company's reaction should a new variant appear, Brad Smith, senior vice president and general counsel at Microsoft, said a new Sasser worm wouldn't change Microsoft's belief that it led police to the Sasser author.

However, antivirus experts raised questions about the timing of the E variant, which wasn't detected by antivirus companies until hours after the arrest. Jaschan provided an 'extensive' confession when he was taken into custody, admitting to creating both the Sasser and Netsky worms in an effort to fight infections of the Mydoom and Bagle worms, according to a statement provided by German authorities.īased on that confession, authorities and Microsoft believed that Jaschan wrote all the versions of Sasser, including a new variant, Sasser-E, that appeared at the time of his arrest, said Brad Smith, senior vice president and general counsel at Microsoft. Microsoft will update its Sasser cleaner tool to detect the new variant, a company spokeswoman said.Īfter receiving tips last Wednesday about the suspected author, identified in news reports as Sven Jaschan, Microsoft provided information to German authorities in Lower Saxony that led to his arrest. Sophos PLC and Panda Software also issued alerts. rated Sasser-F a 'Category 2,' or low-level, threat and released a virus definition update for its products.

What is sasser worm virus