Sasser Infection Plateaus, Drops

As predicted a day before, security analysts on Wednesday watched the Sasser worm attack level off. "Sasser has plateaued," said Alfred Huger, the senior director of engineering with Symantec's response team. On Tuesday, Huger predicted that the worm's growth curve would soon begin to flatten.

"Yesterday, we were seeing about 150 Sasser submissions an hour from customers," Huger said. "This morning we're seeing around 80 an hour. The worm peaked late yesterday afternoon or early evening."

Although Symantec's DeepSight Threat network, a system of sensors and servers it uses to monitor developing exploits, now indicates about 140,000 infected systems -- an increase from the 100,000 of Tuesday -- Huger said that was additional proof that the Sasser crisis has, for now at least, passed.

Jimmy Kuo, a research fellow with security firm McAfee, confirmed the decline in Sasser. "It's leveled off, and is now dropping," he said.

While McAfee spotted 12,000 newly-infected PCs owned by its customers two days ago, that number dropped to 9,000 Tuesday.However, both Huger and Kuo said that while Sasser's growth is slowing, businesses and consumers shouldn't drop their guard, or fail to patch still-vulnerable systems.

"Sasser will be part of the Internet background for months to come," said Kuo.

And there's more cherry news in the future. The next scheduled roll-out of Microsoft vulnerabilities -- "Black Tuesday," as it's called by some security experts, since the Redmond, Wash.-based developer uses the second Tuesday of each month to post patches -- is just six days away.