New worm (virus) is awful. (Win2000/XP)

05-01-2004, 10:17 PM

It's called Sasser, for various stupid reasons, (It uses a vulnerability that can be corrected here in lsass.exe, a part of Windows) although I prefer to call it avserve, because that's the name of one of the worm's more pronouncable components.

Basically, it makes a connection with your computer which, using some flaws in Windows, manages you to run a little bit of code, which is then used to download a larger program which repeats the proccess towards as many computers as it can think of.

To disarm the bug, go into Task Manager (ctrl-alt-del) and select the proccesses tab. Right click on avserve.exe (or something similar) and close it. Do the same thing to something that looks like 37189_up.exe. This closes the program.

To actually remove the bug, delete c:\windows\avserve.exe (or a similarly named file that was just running) and all the c:\windows\system32\37184_up.exe looking files you might have. Also c:\windows\system32\cmd.ftp although you don't actually need to. There's also some registry stuff you might wanna clean up. To do that, you go to Run... and type in "msconfig". Click on the startup tab and unselect "avserve" or anything similar.

But you WILL get the bug again if you don't either get a firewall or update Windows. I suggest the firewall road, because it's safer, easier, and more powerful. This ought to suit your purposes. The built in Windows XP firewall doesn't seem to cut it, so don't even contemplate it.

[ May 01, 2004, 10:20 PM: Message edited by: UserGoogol ]

05-02-2004, 05:43 AM

*points and laughs at all the 2000/XP users*

No-one makes viruses for '98 anymore. Which is one advantage anyway. But it's still annoying that people do stuff like this. What exactly does it do, apart from downloading the code?

05-02-2004, 02:41 PM

While it sends copies of itself to other computers, it really really can slow things down, and it also sometimes messes with the DNS system somehow so you can't go to websites while the program is running unless you know the IP address.

At least, that's what seemed to happen on my computer.

[ May 03, 2004, 03:57 PM: Message edited by: UserGoogol ]

05-10-2004, 06:42 PM

Why do idiots go and do that?

05-01-2004, 10:17 PM	#1
UserGoogol Guest Posts: n/a Points: 0 Bank: 0 Total Points: 0 Donate	It's called Sasser, for various stupid reasons, (It uses a vulnerability that can be corrected here in lsass.exe, a part of Windows) although I prefer to call it avserve, because that's the name of one of the worm's more pronouncable components. Basically, it makes a connection with your computer which, using some flaws in Windows, manages you to run a little bit of code, which is then used to download a larger program which repeats the proccess towards as many computers as it can think of. To disarm the bug, go into Task Manager (ctrl-alt-del) and select the proccesses tab. Right click on avserve.exe (or something similar) and close it. Do the same thing to something that looks like 37189_up.exe. This closes the program. To actually remove the bug, delete c:\windows\avserve.exe (or a similarly named file that was just running) and all the c:\windows\system32\37184_up.exe looking files you might have. Also c:\windows\system32\cmd.ftp although you don't actually need to. There's also some registry stuff you might wanna clean up. To do that, you go to Run... and type in "msconfig". Click on the startup tab and unselect "avserve" or anything similar. But you WILL get the bug again if you don't either get a firewall or update Windows. I suggest the firewall road, because it's safer, easier, and more powerful. This ought to suit your purposes. The built in Windows XP firewall doesn't seem to cut it, so don't even contemplate it. [ May 01, 2004, 10:20 PM: Message edited by: UserGoogol ]

05-02-2004, 05:43 AM	#2
00bvickers Guest Posts: n/a Points: 0 Bank: 0 Total Points: 0 Donate	points and laughs at all the 2000/XP users No-one makes viruses for '98 anymore. Which is one advantage anyway. But it's still annoying that people do stuff like this. What exactly does it do, apart from downloading the code?

05-02-2004, 02:41 PM	#3
UserGoogol Guest Posts: n/a Points: 0 Bank: 0 Total Points: 0 Donate	While it sends copies of itself to other computers, it really really can slow things down, and it also sometimes messes with the DNS system somehow so you can't go to websites while the program is running unless you know the IP address. At least, that's what seemed to happen on my computer. [ May 03, 2004, 03:57 PM: Message edited by: UserGoogol ]

05-10-2004, 06:42 PM	#4
RKM89 Guest Posts: n/a Points: 0 Bank: 0 Total Points: 0 Donate	Why do idiots go and do that?