What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

W32.sasser Removal Tool Available!

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #1
FYI…

W32.Sasser Removal Tool
- http://www.sarc.com/avcenter/venc/data/w32…moval.tool.html
Last Updated on: May 3, 2004 04:16:26 PM
(The tool covers variants of the Sasser Worm)

Additional info:
- http://www.sarc.com/avcenter/venc/data/w32…ser.c.worm.html
"…Block TCP ports 5554, 9996 and 445 at the perimeter firewall and install the appropriate Microsoft patch (MS04-011) to prevent remote exploitation of the vulnerability…"
- http://isc.sans.org/port_details.php?port=445

Also:
- http://isc.sans.org/diary.php?date=2004-05-03
"…We are seeing a great deal of evidence of multiple infections on machines with Sasser. That is, machines infected with Sasser are often also infected with something else, frequently one of the recent agobot/gaobot/phatbot variants that also target the MS04-011 vulnerabilities…"
- http://www.microsoft.com/technet/security/…n/MS04-011.mspx
Post #3
FYI…

- http://www.techweb.com/wire/story/TWB20040505S0007
May 5, 2004
"…While Sasser's growth is slowing, businesses and consumers shouldn't drop their guard, or fail to patch still-vulnerable systems. And there's more cherry news in the future. The next scheduled roll-out of Microsoft vulnerabilities – "Black Tuesday", as it's called by some security experts, since the Redmond, Wash.-based developer uses the second Tuesday of each month to post patches – is just six days away."

…now 5, and counting. :(