Virus Alert! Sasser virus

[Terror]

Alright, this rather new virus has been causing trouble all over the world. Our 2 pc's themselves had problems with it. If you are getting the following symptoms too, go to the http://www.microsoft.com website to download a removal program.

Symptoms:

You get a message box about lsass telling you that there's something wrong etc. If you click ok or cancel you will get another box saying that your pc will restart in 1 minute and counting.

If this happens, you are infected and just download the removal program. I don't think that the virus does much damage.

[gryphon]

Below is a part of the email I recieved about it a few days back.

Sasser Worm: http://isc.sans.org/diary.php?date=2004-04-30

"ISC is aware of the LSASS Sasser worm. This worm is spreading through the MS04-011 (LSASS) vulnerability.

According to AV companies, this worm will generate traffic on ports 445, 5554 and 9996.

Also, it will copy itself in the windows folder, under the name of avserve.exe, create a file at c: called win.log and add the registry.."

http://isc.sans.org/diary.php?date=2004-04-30

I havn't had any infected computers. . although we will see on monday hwo big this worm really is... :)

[syczek]

this  sasser is like blaster, and he is created by antiglobalist,  when poland joined to ue, antiglobalists not wishes polandin ue and for this these people created sasser and issass this second is more dangerous, he deleting files and may damage your motherboard (like cih)

[gryphon]

The link below should hold info on how to remove it manually or with a small tool for it.

http://www.f-secure.com/v-descs/sasser.shtml

McAfee's stinger can be downloaded from here and should also remove it.

http://vil.nai.com/vil/stinger/

Although sofar it seems quiet at work.. . sasser hasn't passed through our corporate firewalls at work, so it's still a boring monday morning for me. :)

[Nyarlathotep]

Please note that if the virus already has rebooted your pc, the removal tool may not work. Best thing you can do then is to download Microsofts patch (click patch available and download the proper version). It seems to automaticly remove everything linked to the worm.

[Kiyouta]

I can't believe some banks and other high security places were affected by this. I thought all businesses used firewalls... obviously not...

[gryphon]

this