Unlike we said earlier in the weblog, there are functional differences between Sasser.C and earlier Sasser variants: it starts up 1024 processes to scan for new vulnerable hosts instead of 128. This should make this variant spread faster. However, right now Sasser.B seems to be the biggest problem.

Also, Sasser.C was not based on A but B variant, ie. the filenames it uses are AVSERVE2.EXE and WIN2.LOG.