The Sasser virus and its variants have been rampaging on the Internet since May 2004. According to the information provided by Symantec, Sasser is an Internet worm spreading through the MS04-011 (LSASS) vulnerability.

This vulnerability is caused by a buffer overrun in the Local Security Authority Subsystem Service, and will affect all machines that are:

- Running Windows XP or Windows 2000
- Haven't been patched against this vulnerability
- Are connected to the Internet without a firewall

Once infected with the Sasser worm, the following symptoms may occur:

- Computer performance is decreased or network connection is slow
- One may see a dialog box that contains text that refers to LSA Shell
- Computer may restart every few minutes without user input

Many organizations and universities worldwide were hit really hard at the time. Fortunately, most of our users hardly noticed this epidemic because:

Despite these, we still see room for improving our preparation for the next wave of attacks. We still have lots of fire-fighting work to tame the viruses spread by improperly protected PCs on campus as well as those at the student hostels and at home that we practically have little or no control of.

The University community must work hand in hand as a whole to secure our network. After all, the security of our network is only as strong as its weakest link.