Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.


Welcome to AstaHost - Dear Guest , Please Register here to get Your own website. - Ask a Question / Express Opinion / Reply w/o Sign-Up!

Toggle shoutbox Shoutbox

@ agyat	:	(24 May 2013 - 05:15 PM) O Dear, Where Are You? Without Your Words This Sb Is ..
@ agyat	:	(23 May 2013 - 01:23 AM) Wow! Mr. Sb Back Home.
@ OpaQue	:	(23 May 2013 - 12:44 AM) Ting
@ OpaQue	:	(24 April 2013 - 02:44 PM) I guess, Time to run Mycent script.
@ OpaQue	:	(24 April 2013 - 02:43 PM) wow.. not much spam. except habatt posting lot of links..
@ yordan	:	(23 April 2013 - 01:04 PM) You're welcome, agyat. Nice to have been helpful. Second lesson: try full words, "you" instead of "EW".
@ agyat	:	(23 April 2013 - 05:03 AM) @YORDAN: tHANK EW FOR YOUR FIRST LESSON.
@ yordan	:	(22 April 2013 - 09:43 PM) @agyat : "why don't you help me", or "please help me", or "please teach us"
@ yordan	:	(22 April 2013 - 09:42 PM) welcome back, velma
@ velma	:	(22 April 2013 - 07:51 AM) yawns Good to be back, wonder what is going on here
@ agyat	:	(22 April 2013 - 03:50 AM) Oh! so, why don't help me learn english..
@ yordan	:	(21 April 2013 - 08:38 PM) The goal mentioned by shiu : "learning english, learning computer"
@ agyat	:	(21 April 2013 - 06:31 PM) WHAT GOAL?
@ yordan	:	(20 April 2013 - 10:39 AM) yes, that's our goal. simultaneouly learning English and teaching/learning computer using.
@ shiyu	:	(20 April 2013 - 07:30 AM) learning english,learning computer
@ yordan	:	(19 April 2013 - 01:11 PM) Oh, I see, it's just a trick in order to force people looking at your texte. Somehow smart, maybe.
@ agyat	:	(19 April 2013 - 02:54 AM) And of course I know it is not SEO friendly.
@ agyat	:	(19 April 2013 - 02:52 AM) There may be two possible answers for that .... 1) Shout was posted using mobile keypad. 2) To force people read content carefully and/or with more concentration.
@ agyat	:	(19 April 2013 - 02:49 AM) There may be two possible answers for that ....
@ yordan	:	(18 April 2013 - 09:35 PM) however, why this mixing of capital letters in the middle of your text?

Replying to How to recognize and remove Sasser Internet worm?

Post Options

Enable emoticons?

Enter Your Name

Security Check *

[quote name="soleimanian" post="1147" timestamp="1094839511"] Name: Sasser Nick name: Sasser.A, Worm.Win32.Sasser.a Size: 15872 All version of this worm attack by "MS04-011 (LSASS)". MS04-011 (LSASS) cause overrun buffer in Local Security Authority Subsystem Service. Related: 1- this worm can run in Win 2000/Xp 2- There isn’t any security Patch. 3- This worm cause connect to Internet without any Firewall. 4- One of the characteristics of this worm is following file "C:\win.log", 5- This worm make a traffic on the TCP,9996,445 and 5554 Ports To remove this worm: 1- go to following address and download anti worm, [url="http://www.f-secure.com/tools/f-sasser.zip"]http://www.f-secure.com/tools/f-sasser.zip[/url] OR 2- go to Microsoft update and download Microsoft patch MS04-011 OR 3- Run Task Manager, close "avserve.exe", and delete AVSERVE.EXE from Windows Dir.[/quote] [quote name="soleimanian" post="1147" timestamp="1094839511"] Name: Sasser Nick name: Sasser.A, Worm.Win32.Sasser.a Size: 15872 All version of this worm attack by "MS04-011 (LSASS)". MS04-011 (LSASS) cause overrun buffer in Local Security Authority Subsystem Service. Related: 1- this worm can run in Win 2000/Xp 2- There isn’t any security Patch. 3- This worm cause connect to Internet without any Firewall. 4- One of the characteristics of this worm is following file "C:\win.log", 5- This worm make a traffic on the TCP,9996,445 and 5554 Ports To remove this worm: 1- go to following address and download anti worm, [url="http://www.f-secure.com/tools/f-sasser.zip"]http://www.f-secure.com/tools/f-sasser.zip[/url] OR 2- go to Microsoft update and download Microsoft patch MS04-011 OR 3- Run Task Manager, close "avserve.exe", and delete AVSERVE.EXE from Windows Dir.[/quote]

or Cancel

Topic Summary

gokul

Posted 19 September 2004 - 11:20 AM

seems that I am the only lucky ***** who newer cought up with a worm or a VIRUS ..

I have been on internet for allmost 2.5 yrs now on my Personal PC ..
and am online most of the times ..

I still newer used a firewall software or even an antivirus software ..
I think all u need to do is be aware of wat u r doing on net and u will newer catch up with one

asimrsiddiqui

Posted 18 September 2004 - 12:07 PM

Microsoft also provides security updates called hot fixes .

This worm is quite annoying! Tsk, it really gave me a hard time when I tried to fix it in my dad's office PC. Dang! Good thing there are articles in the net about fixing things. I found this - http://www.microsoft...ent/sasser.mspx - Well, it provides some protection against the worm but the article is focused on Windows users.

helix

Posted 14 September 2004 - 09:51 PM

Correct. My dad got bit by this virus because he is extremely computer illiterate and keeps turning off his virus scanner somehow. Anyway, he has a current and updated version of norton antivirus. It detected some files infected by sasser but could not clean/delete them due to the nature of the infected files and the virus. The cleaning programs will do some very low level things including cleaning memory, etc to make sure that there is no trace whatsoever of it remaining.

Eric Straven

Posted 13 September 2004 - 02:53 PM

Antiviruses aren't always successful in removing these. You should use removal tools to remove fatal viruses like this

...

zarjay

Posted 13 September 2004 - 02:40 PM

Updated antivirus software should be able to detect it, right? I've always found AVG to be reliable enough in finding any king of intrusion to my computer.

helix

Posted 10 September 2004 - 10:28 PM

Yep, ran into this a number of times. If you are running XP, you probably will want to disable system restore before you remove it (reenable it when you're done).

soleimanian

Posted 10 September 2004 - 06:05 PM

Name: Sasser
Nick name: Sasser.A, Worm.Win32.Sasser.a
Size: 15872
All version of this worm attack by "MS04-011 (LSASS)".
MS04-011 (LSASS) cause overrun buffer in Local Security Authority Subsystem Service.
Related:
1- this worm can run in Win 2000/Xp
2- There isn’t any security Patch.
3- This worm cause connect to Internet without any Firewall.
4- One of the characteristics of this worm is following file "C:\win.log",
5- This worm make a traffic on the TCP,9996,445 and 5554 Ports

To remove this worm:
1- go to following address and download anti worm, http://www.f-secure....ls/f-sasser.zip

OR

2- go to Microsoft update and download Microsoft patch MS04-011

OR
3- Run Task Manager, close "avserve.exe", and delete AVSERVE.EXE from Windows Dir.

Review the complete topic (launches new window)