sasser worm

  • Thread starter Thread starter jstorz
  • Start date Start date
J

jstorz

my computer is re-booting before it gets to the desktop,
I've tried all safe modes (f8) options. I can't even get
by the "welcome" page.This is a spare computer, so
reloading xp is an option, clean sweep would be fine, if
I can just get to the start or run functions.
 
Visit the following website and use the procedure to
remove the "Sasser Worm" from your computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]

3 Steps to Help Insure Your PC is Protected
http://www.microsoft.com/security/protect/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------------


| my computer is re-booting before it gets to the desktop,
| I've tried all safe modes (f8) options. I can't even get
| by the "welcome" page.This is a spare computer, so
| reloading xp is an option, clean sweep would be fine, if
| I can just get to the start or run functions.
 
appreciate the advice, BUT I CANNOT get to the start /run
command, which is the first step in ALL the removal
procedures.Safe mode slows down the reboot even more and
I cannot load any commands into the system. Does anyone
know how to speed up the reboot process to give me that
20 seconds that I need?
 
Try the following:

How to Perform a Windows XP Repair Install
http://www.michaelstevenstech.com/XPrepairinstall.htm

If unsuccessful, then:

Clean Install Windows XP
http://www.michaelstevenstech.com/cleanxpinstall.html

3 Steps to Help Insure Your PC is Protected
http://www.microsoft.com/security/protect/


Make sure to physically disconnect your internet connection
before doing either. Then enable the firewall immediately!
Afterward, visit the Windows Update website and download
all the suggested Critical Updates.

HOW TO: Enable or Disable Internet Connection Firewall in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;283673&Product=winxp

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------------


| appreciate the advice, BUT I CANNOT get to the start /run
| command, which is the first step in ALL the removal
| procedures.Safe mode slows down the reboot even more and
| I cannot load any commands into the system. Does anyone
| know how to speed up the reboot process to give me that
| 20 seconds that I need?
 
What you're seeing is not sasser. (This is a common point of confusion.
Both sasser and blaster fully boot to the desktop and display a distinct
message for 60 seconds and then shutdown.)

There are several possible causes of the reboot pattern you are seeing, but
the most common relates to damage caused by one of several possible spyware
infections (and sometimes by ad-aware when cleaning them). Here's the
repair process. If you find this too difficult, you could alternatively, do
a repair install.


(INFECTION AGENT) replaces userinit.exe used in logon with its own
wsaupdater.exe. But uninstalling doesn't revert it back.
some adaware programs may also remove or quarantine wsaupdater.exe thinking
that it's harmful.

Fix:
1. Boot using your winxp cd.
2. Enter recovery console.
3. at the command prompt go to C:/windows/system32
4. next type: copy userinit.exe wsaupdater.exe
5. exit and reboot normally. You should now be able to logon. But you're not
done yet!
6. run regedit
7. find the Userinit key in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

8. modify the entry:

C:\WINDOWS\System32\wsaupdater.exe,

so that it reads:

C:\WINDOWS\System32\userinit.exe,
** Make sure you have the comma!
 
Back
Top