|
Please Read - Security Advisory Windows. W32/Sasser.worm
|
View this Thread in Original format
| Rostros |
* Admins you might want to Pin this Topic.
Ive been infected for a few days by this W32/Sasser.worm Its is exactley like Ms Blaster but harder to get rid of. I have McAfee 2004 Virus software which is updated everyday and i have Sygate pro firewall, and i still got infected. Here is info how to remove it.
The virus copies itself to the Windows directory as avserve.exe and creates a registry run key to load itself at startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve.exe" = C:\WINDOWS\avserve.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.
A file named win.log is created on the root of the C: drive. This file contains the IP address of the localhost.
Copies of the worm are created in the Windows System directory as #_up.exe.
Examples
c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs. The following Window may be displayed:
Method of Infection
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host is accepts this FTP traffic on TCP port 5554.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445
Removal Instructions
All Users :
Use the specified DAT files for detection and removal.
Alternatively, the following EXTRA.DAT packages are available.
EXTRA.DAT
SUPER EXTRA.DAT
Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/se...n/MS04-011.mspx
Additional Windows ME/XP removal considerations
Stinger
Stinger has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode
Stinger
Original Virus Info
- Dont get caught Out |
|
|
| MaRt |
| So I guess if you're up to date at Windows Update you're not at risk of getting this... |
|
|
| DrUg_Tit0 |
| Wow, thanx man. It's been bugging me for 2 days. |
|
|
| getfoul |
| i thought it was about time for another windows bug, it was a dryspell for a while. |
|
|
| paranoik0 |
| humm here the home computer was acting weird, using 100% cpu until it showed up a lack of memory, noticed avserve.exe was causing the problem, and simply deleted it, seems to be working right now. any side effects of this way of solving the problem? |
|
|
| Sand Leaper |
| This is pissing me off. I've tried numerous ways of disinfection but nothing has worked. To add insult to injury, the worm locks me out of Windows Update AND System Restore, meaning that most likely whatever means of disinfection I try will be futile in the end. Thankfully I have all of my stuff on another seperate hard disk, so I'll just reformat this one and be done with it. |
|
|
| Boomer187 |
lol, so thats why my system shut down liek that...hehe,
sweet I am infected. |
|
|
| T-1000 |
| McAfee Antivirus Sucks. Well, for the most part it does. Get F-Secure |
|
|
| smokeape |
Yeah, one of my kid's computers got hit with the damn thing Thursday night or Friday. Was driving me nuts because Norton Antivirus wasn't doing a damn thing to help either. Had to D/L Norton DAT file to update my antivirus because for some reason I couldn't use the Live Update. McAfee and Microsoft finally came out with the solution and cleaners for it yesterday, but I already had it solved in the geek forums by then.
This one was unusual because it wasn't spread through e-mail like most. It should peak tomorrow when folks go back to work. Expect more like that this summer with the release of the Windows code earlier this year and the fact that hackers got more time off.
:mad:
[[[smoke]]] |
|
|
| ::TranceVanDyk:: |
THANK YOU MAN!!
i have this, i was about to go to microsoft.com to see what i could do. but this explained it all. now, lets hope that i can delete this worm before my system shuts down again at any time...
EDIT:::Does downloading the update take the worm off the system?? |
|
|
| smokeape |
I particularly hated this part of the virus...
| quote: |
|
Lol! Hey, Rostros, you did a g*damn superlative job explaining the whole thing on your post and I mean a really great job!
Cheers to you!
[[[smoke]]]
Sun Decade - Follow You (Original vocal) |
|
|
|
|
