The SASSER Worm/ NT Authority Shutdown

The SASSER Worm is the latest "Big Deal" out there, and is even more dangerous in that no user action is required to infect a machine; merely being on the internet without the necessary Microsoft Critical Updates and Security Patches, and no properly configured Firewall or AntiVirus is all it takes. While not directly affected by the "NT Authority Shutdown issue, Windows 9x/ME machines may still be infected, passing on the critter to later-version Windows machines, where the worm can and does raise havoc. Currently, there are at least 4 variants of the critter identified, and its rate of spread is accellerating. I have been busy all day clearing it from machines of freinds and clients, and have found it frequently accompanied by a couple other nasties. From the look of things, I'll be pretty busy for the next couple days at least.

Microsoft offers a Free Detection and Removal Tool, and free tools also are available at:

Computer Associates

F-Secure

Network Associates

Norman

Panda

Sophos

Symantec

Trend Micro

A fully updated Operating System along with a properly configured and currently updated Firewall and AntiVirus are absolute necessities, both to protect yourself and to prevent your machine from becoming a distribution point for things such as the Sasser Worm. Be certain your Internet Explorer and your version of Widows are current by frequently visiting Windows Update, and if you do not already do so, equip yourself with both a Firewall and an AntiVirus. Below is an assortment of some which are downloadable and offer free trial periods.

EZ-Armor Full Version 12 Month free trial, includes AntiVirus

F-secure Full Version 6 Month free trial, includes AntiVirus

Panda Full Version 90 Day free trial, includes AntiVirus

Norton/Symantec Individual Full Version 90 Day free trials of Firewall and AntiVirus

Trend Micro Basic limited-feature edition 30 Day free trial, includes AntiVirus

Norman[/] Basic limited-feature edition 30 Day free trial, includes AntiVirus

ZoneAlarm Basic, limited-feature edition is free, subscription-for-fee upgrades offer more features and protection, Firewall only, no AntiVirus included.

Kerio Basic limited-feature edition 30 day free trial, Firewall only, no Antivirus included.


There are plenty of others from which to choose, just choose and use SOMETHING.

A major problem is that an infected machine may not be able to access the internet long enough to make use of the online removal tools. The removal method I've been using is as follows:

From an uninfected machine, go to STINGER, read and understand the instructions (print them out for good measure), then download Stinger to a floppy disk. Also download Trend Micro's "SysClean" Tool; which, at about 3.5MB, will require 3 floppies or some other higher-capacity portable mass storage device ( I've been using a USB Flash Drive, but a CD-R or a Zip Disk could be used as well). Along with the tool, be sure to download the latest data file, as detailed in the accompanying Read Me File

Boot the infected machine into safemode:

Starting Win 9x/ME in Safe Mode[/i][/b]

Starting Win 2K in Safe Mode[/i][/b]

Starting Win XP in Safe Mode[/i][/b]

If the infected machine is running WinME or WinXP, Disable System Restore (Note: you will lose any saved restore points; when the "Fix" process has been completed, re-enable System restore and establish a new restore point).

Load the disk containing Stinger into the infected machine's floppy drive, and copy Stinger to a folder of its own on the infected machine's C: drive. Create a folder on the C: drive by right-clicking "My Computer", then selecting "Open". From within the "My Computer" folder, find the folder or icon which represents your C: drive, right-click on that, and again select "Open". From that folder's toolbar, select "File", the select "Folder". A "New Folder" will appear; name the folder "Stinger", and copy Stinger from the floppy into that folder, eject the floppy, then click on the icon to run Stinger from that location.

When that has completed, do not reboot. Go to Start > Settings > Control Panel, and select "Internet Options". From the "General tab, delete Cookies, and Delete Files, selecting "Delete all offline content" at the prompt. Next click the "Security" tab, and click on each icon there to make sure each zone is set to its "Default Level". Next, click on the "Privacy" tab, and again be sure "Default Level" is selected. Finally, click on the "Advanced" tab, and be sure that is set to "Default Level" as well. Click "Apply", then click OK, but do not reboot at the prompt. Go to Start > My Computer > Drive C: > Windows > Temp, and open the "Temp" folder. From the tool bar, click "Edit", them click "Select All". Click "File", select "Delete", and confirm you wish to delete all files (including any individual files for which you may receive additional confirmation prompts). When that has been accomplished, close out of all windows and from the desktop, right-clickthe Recycle Bin, select-and-confirm "Empty Recycle Bin".

Reboot back into safemode, and create a folder on the C: drive for Trend's removal tool, and copy the files from those floppies, or from whatever media you have them on, into that folder (a Win9x/ME machine probably won't recognize a USB device while in safemode, so you'll likely have to boot normally to access and transfer the files if that's how you have them, then boot into safemode to run the fix). Following the instructions from the "Read Me" file, run Sysclean from that location. When it has completed, once again empty the Windows "Temp" folder, then empty the Recycle Bin.

If the infected machine is running WinXP, enable the built-in Windows XP Firewall[/i][/u].

Reboot normally, connect to the internet, and go immediately to Windows update and obtain all Critical Updates and Security Patches. Finally, go to Microsoft's Free Detection and Removal Tool, run the scan to be sure (and the fix, if needed, but so far I haven't found it necessary to run the fix).

Finally, make sure the machine has current and properly configured Firewall and AntiVirus applications installed and running. And of course, after all that poking and shoving. the machine could use a defrag as well.