Sasser virus

[v12v8]

How do you get rid of it?

[bga]

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

[v12v8]

Thanks bga. Very useful.

Howwever, the computer will not start, so I can't download the fix. I have tried starting the computer in safe mode - no joy.

The killer is that I had Norton anitvirus (fully upgraded) running at the time, but the virus still got in (worryingly).

Any fuurther help appreciated.

[Podie]

If the system gives you the countdown before you are able to download anything, the shutdown utility can abort a shutdown that is in progress (counting down).

Click START, RUN
Type SHUTDOWN -A and hit ENTER

Sasser exploits a vulnerability within Windows that needs to be patched - www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Use the McAfee Stinger tool to blat it first - http://vil.nai.com/vil/stinger/

If that doesn't help… you'll have to get your hands dirty (I accept no responsibility if you screw your system up)….

Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.

Delete the file AVSERVE.EXE from your WINDOWS directory (typically c:windows or c:winnt)

Edit the registry

Delete the "avserve" value from
HKEY_LOCAL_MACHINESOFTWAREMicrosoft
WindowsCurrentVersionRun

Reboot the system into Default Mode

Best of luck!

[v12v8]

Cheers Podie. I'll try the reboot you suggest and see how I get on.