Sasser got its name because it spreads by exploiting a buffer overflow vulnerability in a Windows computer’s Local Security Authority Subsystem Service (LSASS) component, which verifies the validity of user logins.
To infect a system, the attackers connect to a vulnerable computer’s TCP port 445, although further analysis revealed that it could also enter through port 139, commonly used for file sharing.
Its effectiveness also gave rise to three other variants—Sasser.B, Sasser.C, and Sasser.D—which appeared within days of the original. Its most noticeable effect is shutting down an infected computer’s timer that appears when the worm crashes LSASS.exe.