This is a bad one friends!  Please, check and make sure that you have the latest updates on your anti-virus programs!  This virus has mutated many times and should be watched carefully!The folloing is from Symantac (Norton Anti-Virus):W32.Sasser.B.Worm is a variant of W32.Sasser.Worm. It attempts to exploit the LSASS vulnerability described in Microsoft Security Bulletin MS04-011. This worm spreads by scanning randomly selected IP addresses for vulnerable systems.

W32.Sasser.B.Worm differs from W32.Sasser.Worm as follows:
    [*]Uses a different mutex: Jobaka3. [*]Uses a different file name: avserve2.exe. [*]Has a different MD5. [*]Creates a different value in the registry: "avserve2.exe."[/list]

    Notes:
      [*]The MD5 hash value of this worm is 0x1A2C0E6130850F8FD9B9B5309413CD00. [*]Symantec Security Response has developed a removal tool to clean the infections of W32.Sasser.B.Worm. [*]Block TCP ports 5554, 9996, and 445 at the perimeter firewall and install the appropriate Microsoft patch (MS04-011) to prevent the remote exploitation of the vulnerability. [/list]

      W32.Sasser.B.Worm can run on, but not infect, Windows 95/98/Me computers. Although these operating systems cannot be infected, they can still be used to infect the vulnerable systems to which they are able to connect. In this case, the worm will waste a lot of resources so that programs cannot properly run, including our removal tool. (On Windows 95/98/Me computers, the tool should be run in Safe mode.)

      Also Known As:

      WORM_SASSER.B [Trend], W32/Sasser.worm.b [McAfee], Worm.Win32.Sasser.b [Kaspersky], W32/Sasser-B [Sophos], Win32.Sasser.B [Computer Associates], Sasser.B [F-Secure], W32/Sasser.B.worm [Panda], Win32/Sasser.B.worm [RAV], W32/Sasser.B [F-Prot]

      Systems Affected:

      Windows 2000, Windows XP

      Systems NOT Affected:

      DOS, Linux, Macintosh, Novell Netware, OS/2, UNIX, Windows 3.x, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003



      Susie in MN