Sasser: 22 years of the birthday worm that froze Windows XP

You were on Windows XP in 2004 and suddenly the computer started freezing, rebooting on its own, showing that countdown window saying the system would shut down in 60 seconds — and it didn't matter what you did, the countdown wouldn't stop. It happened again. And again. And again. Without opening any suspicious attachment, without clicking on anything. The computer simply collapsed of its own accord.

That was Sasser. And today, 29 April 2026, it turns exactly 22. Released on this same date in 2004 by an 18-year-old German student who chose his own birthday to let the worm loose on the world.

A worm that didn't need your help to get in

The most important difference between Sasser and most of the viruses that came before it lies in a technical detail with enormous consequences: it didn't need you to do anything to infect your machine.

Traditional viruses depended on some action by the user — opening an email attachment, running a dodgy file, clicking the wrong link. Not Sasser. It spread completely autonomously across the network, scanning random ranges of IP addresses looking for vulnerable machines. If your Windows XP or Windows 2000 box was exposed to the internet without the right patch, it was a matter of time — not of bad luck.

The vector was LSASS, short for Local Security Authority Subsystem Service: a core Windows component responsible for user authentication and security policy management. Sasser exploited a buffer overflow in that service — the vulnerability documented by Microsoft in bulletin MS04-011 — by sending a malformed request over TCP port 445. If the machine didn't have the patch installed, LSASS.exe crashed, and Windows started a 60-second countdown before forcing a system shutdown.

As it infected, each compromised machine became a distribution node: Sasser installed a rudimentary FTP server on the infected PC and used it to transmit copies of itself to the next victims found during the IP scan. The more machines, the more scanning. The more scanning, the more infections.

The patch that existed but nobody installed

The most frustrating part of the Sasser story is that the hole it exploited had already been plugged when it was released.

In April 2004, Microsoft shipped MS04-011 as part of its monthly security update cycle — the famous Patch Tuesday. The patch fixed the LSASS vulnerability. It was available. It was free. All you had to do was apply it.

But the reality of 2004 was that automatic updates were not the default on Windows XP. People updated when they remembered, when there was time, when the computer wasn't busy with something else. Companies had slow processes for validating and deploying patches across corporate estates. The result was predictable: millions of machines connected to the internet running a version of Windows with a known vulnerability and no fix installed.

Sasser was released just two weeks after the patch. More than enough time for the vast majority of machines still to be unprotected.

Cancelled flights, a news agency in the dark

Sasser had no deliberately destructive payload — unlike the CIH virus, which fried your PC's BIOS. It didn't delete files, didn't format disks, didn't steal passwords. But the combination of constant crashes and reboot loops on critical systems caused damage no company wanted to be dealing with.

Agence France-Presse (AFP), one of the world's largest news agencies, had all its satellite communications knocked out for hours. Delta Air Lines had to cancel several transatlantic flights because its check-in and ticket processing systems were in continuous collapse. Banks, hospitals and telecoms operators in several countries reported outages in their internal systems.

More than a million computers running Windows XP and Windows 2000 were infected in the first few hours. The propagation speed was enough to saturate corporate internet links and cause widespread slowdowns across entire networks.

Sven Jaschan: arrested eight days later

Sasser's creator was Sven Jaschan, 18, a computing student from Rotenburg, in Lower Saxony, Germany. He released the worm on 29 April 2004 — his own birthday. It isn't documented whether the timing was deliberate or coincidence, but the signs of someone new to cybercrime were everywhere: the code, though functional, had characteristics that led investigators straight to him.

Jaschan had also created the Netsky worm — an entire family of variants circulating by email which, combined with Sasser, made April 2004 a particularly miserable period for system administrators the world over.

On 7 May 2004 — eight days after Sasser's release — German police arrested Jaschan. He was handed to the authorities by an acquaintance who had read about the $250,000 reward Microsoft was offering for information leading to the worm's creator. Real friends, as they say.

In July 2005, Jaschan was given a 21-month suspended sentence — no time served. German law at the time, combined with the fact that he was under 18 when he began writing the code, limited the severity of the sentence. Years later, he went to work in information security.

What Sasser taught — and what we keep ignoring

Twenty-two years on, Sasser's most important lesson still needs repeating because it still hasn't been fully learnt: patch management is not optional.

The vulnerability was documented. The patch existed. The security bulletin was public. And even so, the two-week window between the patch's release and the worm's release was enough to infect a million machines. Today, with far more complex systems, far slower update cycles in corporate environments and an exponentially bigger attack surface, the problem hasn't improved — it's got harder to manage.

Sasser was also one of the first worms to demonstrate at real-world scale what happens when critical infrastructure depends on unpatched software. Flights cancelled because of a worm in a check-in system. A global news agency's communications knocked out by an infected Windows machine in a server room. The idea that "this won't affect me" died in April 2004 — or should have.

Windows XP got Service Pack 2 in August 2004, four months later, with significant security changes — including the firewall enabled by default, which would have blocked port 445 and stopped Sasser from spreading in most cases. Too late for the million machines that had already frozen and rebooted in a loop, but in time to prevent the next wave.

If you lived through that period on a help desk, in some company's IT department, or simply trying to stop your PC rebooting in a loop while you tried to finish a piece of work — tell us in the comments. And if you'd like to stay on the subject of malware with history behind it, the CIH Chernobyl virus, which triggered five years before Sasser, did far worse things to actual hardware.