W32.SasserB worm is the new virus of the day

The virus of the day is the W32.SasserB worm. Unlike most viruses that arrive via email attachments, the Sasser worm arrives via an open Internet connection on the computer.

What does this mean? When we connect to the Internet through a dialup, dsl or cable connection, our computer generates a return address so that the Internet knows where to find us. It is immaterial whether this address is permanent or temporary. It is needed. It is similar to us telephoning a stranger. We need to leave our own telephone number so the person can call us back. When we want to look at the web site, the "computer in the sky" must know our computer's return address to send us the web page. This return address is known as the computer's IP (Internet Protocol) address. Typically a new and unique IP address is generated in our computer each time we connect to the Internet.

The Sasser virus can enter our computer IF WE ARE CONNECTED TO THE INTERNET AT THE TIME. For dialup, this means any time we are connected. For dsl or cable, this is any time our computer is turned on.

The 18 year old German youth who allegedly wrote the Sasser virus exploited a vulnerability in Microsoft's Windows 2000 and Windows XP. His virus randomly searches the Internet for a real IP address of a connected computer. If it finds an "open" computer that is unprotected, it installs the virus. Then the problems begin. Older Windows or other operating systems are not affected.

The first line of protection for the Sasser virus is a "firewall" installed on our own computers. Firewalls come in many forms. Windows XP has a built in firewall that can be enabled by going to Start - Control Panel - Network Connections - left double click on Properties - click on Advanced. If you forget this, simply go to Help and type in firewall.

McAfee and Symantec offer firewalls. Zone Alarm ( offers a free, downloadable firewall. If you have a home network that uses a router, usually there is a built in firewall. As a note, you should only have one firewall enabled on your computer at a time.

Firewalls in theory are devices that filter your Internet requests. Like your telephone call: you call a number. If that number returns your call, it is let through. If someone else tries to call you instead, that call is blocked. So if a virus computer is randomly calling IP addresses, the firewall will block it.

Incidentally, if you would like to check if your firewall is working, go to, click on "Shields Up" and follow the directions.

If your virus protection program is up to date, you also should be protected from Sasser.

Sasser or other recent viruses have not affected me even though I have dsl and my computer always is connected to the Internet any time it is turned on. But I take a number of precautions. I do have a firewall that is part of my network router. I have Windows XP Home Edition and have enabled the "automatic update" (Start - Control Panel - System - Automatic Update) to install the Microsoft fixes as they are released. I subscribe to the McAfee Clinic where I pay yearly and receive automatic program upgrades and virus file updates. Norton has a similar program. I have set Outlook Express, my email program, to display "Text Only," (Tools - Options - Read - check "text only"). Inserted email images appear as attachments and no embedded scripts are executed. Finally, I do not open any attachments except pictures. So far, no viruses.

If you would like to hear more about Sasser, firewalls and virus protection, or other computer topics, visit "Coffee and Computers" at the Tustin Area Senior Center, 200 S. 'C' Street, any Friday morning starting at 9 a.m. Bring your questions or just come in and visit.

In the mean time, keep the neurons happy, synapses snapping and enjoy computing.


Dr. Art Holub is a long time resident of Tustin and teaches computer and Internet courses at the Tustin Area Senior Center and the Tustin Adult School. Visit his web site at: This column is written to address the computer adventures and concerns of older adults. If you have comments, questions or suggestions for future columns, Email HIM at:

Return to Doc's Home Page