W32.Sasser Removal Tool
Last Updated on: May 3, 2004 04:16:26 PM
(The tool covers variants of the Sasser Worm)
"...Block TCP ports 5554, 9996 and 445 at the perimeter firewall and install the appropriate Microsoft patch (MS04-011) to prevent remote exploitation of the vulnerability..."
"...We are seeing a great deal of evidence of multiple infections on machines with Sasser. That is, machines infected with Sasser are often also infected with something else, frequently one of the recent agobot/gaobot/phatbot variants that also target the MS04-011 vulnerabilities..."