To some MVP: SASSER question

  • Thread starter Thread starter Maat
  • Start date Start date
M

Maat

I dont have any problem whit this virus, but i want to
know for a discussion whit some friends, about a system
after a infection that was cleaned and patched, if is
necesary to format an reinstall the OS.

Thx in advance
 
Maat said:
I dont have any problem whit this virus, but i want to
know for a discussion whit some friends, about a system
after a infection that was cleaned and patched, if is
necesary to format an reinstall the OS.
Hi

No, that is not necessary...
 
I'm in no danger of becoming an MVP,but here's SANS
Internet Strom Center take on this question,published
this morning:

A reader asked why we recommend a complete rebuild of
systems infected with 'sasser', given that 'sasser' is
rather benign and easy to clean.

The problem with 'sasser' is that it is an indicator
exploit. The fact that you are infected with 'sasser'
indicates that you were vulnerable to the LSASS exploit.
Before sasser, a large number of bot variants exploited
this same vulnerability. We find that many systems
infected with 'sasser' are infected with one or more bots
in addition to 'sasser'.

Each day, we receive several distinct 'bot' samples.
Antivirus signatures are typically not able to keep up
with all versions, and many 'bots' include specific code
to plant backdoors, disable firewalls and antivirus
products, or to add additional system accounts.

Antivirus software is not able to reliably detect and
clean all of these bots. As a result, it is impossible to
tell if any of these bots are left on your system. Only a
thorough (and costly) forensics analysis by a trained
specialist will provide some assurance.

As a result, if you are infected by 'sasser', try to
rebuild your system from scratch. For detailed
instructions on setting up a new system safely, see
http://www.sans.org/rr/papers/index.php?id=1298 (Windows
XP: Surviving the first day). If you acquire a new
system, assume it is not yet patched and use extreme care
the first time you connect it to the network.
 
Greetings --

No, of course, a format of the hard drive is _not_ necessary after
removing a virus. Can't even imagine why anyone would ever think it
would be.

Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Greetings --

If you like using an axe to trim your fingernails, follow that
advice.

Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Hello i am new in this forum and i am in need for ur hellp

i dont know how but my computer keeps shuting down i downloaded some
win updats for sasser and it stoped but when i search for sasser there
was no where to be found ..... after that computer works fine but
somthing is not leting my firewall and antivirus to work , i try do
uninstal and install but it would not let me install them .........plz
hellp i am desprate hellp me

Thx :)
 
1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt259.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

* * * Please report your results ! * * *

Dave





|
| Hello i am new in this forum and i am in need for ur hellp
|
| i dont know how but my computer keeps shuting down i downloaded some
| win updats for sasser and it stoped but when i search for sasser there
| was no where to be found ..... after that computer works fine but
| somthing is not leting my firewall and antivirus to work , i try do
| uninstal and install but it would not let me install them .........plz
| hellp i am desprate hellp me
|
| Thx :)
|
|
| --
| D3v!L
 
Back
Top