Page 1 of 2 12 LastLast
Results 1 to 15 of 20
  1. #1
    New Lounger
    Join Date
    Apr 2004
    Location
    Sydney, New South Wales, Australia
    Posts
    12
    Thanks
    0
    Thanked 0 Times in 0 Posts

    SASSER Worm (XP V5.1)

    I was a tagget of the Sasser Worm over the last few days. While I have now removed it and modified the registry entry that requests the running of "avserve.exe" I have a problem with LSASS.EXE failing while connected to the internet. I don't get enough time to locate and download the MS patchs. Could someone advise the patch required? (I have XP Home Edition Ver 5.1 (Build 2600.xpsp2.030422-1633 : Service Pack 1). Can I download the patchs to my Win98 machine and then copy it to my XP machine? Thanks Alank.

  2. #2
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: SASSER Worm (XP V5.1)

    You can download the patch (as a file, so you can download it on one PC, then transfer it to another one) from Security Update for Windows XP (KB835732) and the removal tool from Sasser.A and Sasser.B Worm Removal Tool (KB841720).

    You can also download a removal tool from Symantec: W32.Sasser Removal Tool.

  3. #3
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: SASSER Worm (XP V5.1)

    Alan

    If you don't keep your operating system up-to-date with security patches (and very occasionally, even if you do!), and certainly your antivirus software also with new virus patterns, you could be hit again by a new virus. It would be a good move if you found out now where to look for information on how to remove infections from your machine, Google being one source and a few of the antivirus software manufacturers being another. In the Lounge there have been posts about programs which assist with this problem (which can be Searched for), such as Spybot Search and Destroy (or abbreviated as Spybot S&D) and Ad-Aware (Personal = free).

    I expect acting on Hans's suggestions will work successfully (as is invariably the case)!

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  4. #4
    3 Star Lounger
    Join Date
    Nov 2001
    Location
    Brooklyn, New York, USA
    Posts
    200
    Thanks
    2
    Thanked 0 Times in 0 Posts

    Re: SASSER Worm (XP V5.1)

    In response to Alan's problem (I too was hit with the worm, no fun!):

    I also can't do anything in enough time before the system shuts itself down. I called Dell, and the technician told me to restart the computer in safe mode (press the F8 key constantly while it's starting so you don't go to the logo.Then you choose "advanced option" from the safe mode menu, bypass the admin login, and continue with your downloads.)
    Also, he informed me that the patch includes the worm removal software - will happen automatically - so I'm wondering why the previous posters suggest both the patch and the worm removers.

    thanks
    Naomi

  5. #5
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: SASSER Worm (XP V5.1)

    The Dell technician may be right, but What You Should Know About the Sasser Worm and Its Variants on the Microsoft website describes the following steps to be taken:
    Step 1. Enable a firewall.
    Step 2. Install the required update.
    Step 3. Automatically Check For and Remove Sasser.A and Sasser.B.
    There is a warning accompanying step 3:
    <hr>Important To use this tool, you must be running Windows XP or Windows 2000, and you must have already installed the update released with Microsoft Security Bulletin MS04-011.<hr>
    This made me conclude that the patch and the tool are two different downloads.

  6. #6
    Silver Lounger Duchess843's Avatar
    Join Date
    Apr 2002
    Location
    Sicklerville, NJ
    Posts
    2,488
    Thanks
    36
    Thanked 0 Times in 0 Posts

    Re: SASSER Worm (XP V5.1)

    Considering all the problems with the Microsoft patch for the Sasser worm, I would like to hear from loungers .
    Subject: Knowing what you know about installing the patch, would you install it again?

    I've always seen on this board where it's suggested to Not jump right in and install a patch until the bugs are worked out. Wether I install it or not, depends on loungers concerted opinions..
    <img src=/S/coffeetime.gif border=0 alt=coffeetime width=32 height=48>

  7. #7
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: SASSER Worm (XP V5.1)

    I installed the update KB835732 when it came along in April and have had no problems with it. I haven't been infected with the Sasser worm, so I haven't had to download and use the removal tool.

  8. #8
    Silver Lounger Duchess843's Avatar
    Join Date
    Apr 2002
    Location
    Sicklerville, NJ
    Posts
    2,488
    Thanks
    36
    Thanked 0 Times in 0 Posts

    Re: SASSER Worm (XP V5.1)

    Thank you Hans. It may be of interest to you that you are the very first to respond. At the end of today, I'll tally the responses and take it from there.
    <img src=/S/coffeetime.gif border=0 alt=coffeetime width=32 height=48>

  9. #9
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: SASSER Worm (XP V5.1)

    I installed the KB835732 update some 14 days ago, and have not seen or experienced any problem on my computer. Somewhere in the Lounge it was mentioned about CPU usage 100 % on win2000, and it's also mentioned in KB835732 (together with some other problems). In this case I suppose one have to stay off the net long enough to check if the update generate any big problems. To answer your question; there is (almost always?) things that can occur after installing an update. So it can be a good idea to wait some hours/days to read if someone with a system like yours has reported any problems. And yes I would install it again.

  10. #10
    Super Moderator
    Join Date
    Dec 2000
    Location
    Renton, Washington, USA
    Posts
    12,560
    Thanks
    0
    Thanked 4 Times in 4 Posts

    Re: SASSER Worm (XP V5.1)

    Like wise, I have installed all critical updates for some time now, and have not had any problems.

    Now running HP Pavilion a6528p, with Win7 64 Bit OS.

  11. #11
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,571
    Thanks
    5
    Thanked 1,057 Times in 926 Posts

    Re: SASSER Worm (XP V5.1)

    I have all the critical updates installed with no problems. The issues that I've read about have been with Win2k not XP.

    Joe
    Joe

  12. #12
    Silver Lounger Duchess843's Avatar
    Join Date
    Apr 2002
    Location
    Sicklerville, NJ
    Posts
    2,488
    Thanks
    36
    Thanked 0 Times in 0 Posts

    Re: SASSER Worm (XP V5.1)

    Thank you Argus for your reply. So far you are among the majority., their are no negatives votes.
    <img src=/S/coffeetime.gif border=0 alt=coffeetime width=32 height=48>

  13. #13
    Plutonium Lounger
    Join Date
    Nov 2001
    Posts
    10,550
    Thanks
    0
    Thanked 7 Times in 7 Posts

    Re: SASSER Worm (XP V5.1)

    Here's another positive vote for you. I have 4 Windows XP Professional systems and all have been regularly updated with critical updates for the past few months with no noticable problems.

    StuartR

  14. #14
    Platinum Lounger
    Join Date
    Jan 2001
    Posts
    3,788
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: SASSER Worm (XP V5.1)

    The UK Coastguard had their computer systems brought down by this worm.

  15. #15
    New Lounger
    Join Date
    Apr 2004
    Location
    Sydney, New South Wales, Australia
    Posts
    12
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: SASSER Worm (XP V5.1)

    Hans, John,

    Thank you, thank you! I was able to download the Symantec removal tool to my Win98 machine and the copy it across to the problem XP machine and run it successfully. Patch (KB835732) was then downloaded and installed without any problems.

    My apologies for not reporting back earlier but it seems there are others in the same boat after looking at all the other posts. I am new to XP and have read the ezines WWW & WOW describing the patchs put out by MS and the new problems that they sometimes create, so I put off doing updates until I was more familar with XP. I guess this was a real gotch ya!. I have now installed all the critical updates for my XP machine.

    Again, thanks to all!
    Alank

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •