Google Answers Logo
View Question
 
Q: Sasser Worm Elimination ( Answered,   0 Comments )
Question  
Subject: Sasser Worm Elimination
Category: Computers > Security
Asked by: belle2-ga
List Price: $50.00
Posted: 25 Jul 2004 09:28 PDT
Expires: 24 Aug 2004 09:28 PDT
Question ID: 378813
After crashing and reinstating my WindowsXP operating system, I
reinstalled my internet connection, then began my Windows Udates. 
During this procedure I received a notice that my computer was STILL
infected with the Sasser Worm. I have run Norton Antivirus several
times, to no avail. What can I do to RID MY COMPUTER of this worm?
Answer  
Subject: Re: Sasser Worm Elimination
Answered By: palitoy-ga on 25 Jul 2004 09:45 PDT
 
Hello Belle2

There are several different variants of this virus each of which are
tricky to remove, because of this several tools have been made
available specifically for the elimination of this virus.  These tools
compile all the steps required to remove the virus into a small
program that you can download and run.

There are two tools I would trust to remove this virus - one from
Microsoft and one from Symantec (who make Norton Antivirus). 
Personally I would choose the Symantec version as viruses are their
speciality and their instructions are better!

Symantec Sasser removal tool:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

Microsoft removal tool:
http://www.microsoft.com/security/incident/sasser.mspx
http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displaylang=en

These are the steps you should follow for the Symantec removal tool:
1) Download the FxSasser.exe file from:
http://securityresponse.symantec.com/avcenter/FxSasser.exe.
2) Save the file to a convenient location, such as your Windows desktop
3) Close all the running programs before running the tool. 
4) Disconnect from the internet and any networks to which you are attached.
5) Disable System Restore.
6) Double-click the FxSasser.exe file to start the removal tool. 
7) Click Start to begin the process, and then allow the tool to run. 
8) Restart the computer. 
9) Run the removal tool again to ensure that the system is clean. 
10) Re-enable System Restore. 
11) Run LiveUpdate in Norton Anti-Virus to make sure that you are
using the most current virus definitions.

One of the most overlooked steps in this procedure is step 5.  IT IS
NOT AN OPTION TO SKIP THIS STEP!  If you do skip this step (which many
people do or forget that they have System Restore enabled), the virus
will not be removed as it will still be present in your backed-up data
and will immediately re-infect your machine.  This link is a useful
guide in how to turn this feature off temporarily:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

Good luck with the removal.  If you have any further questions or need
any further help regarding this virus removal please ask for
clarification and I will do my best to help.
Comments  
There are no comments at this time.

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy