_up.exe

[ross]

in my registry there is a
key, 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curren
tVersion\Run\avserve.exe'
its value is '"C:\WINDOWS\avserve.exe"'
i dont know what this is, something bad i thought.
Also there are files that run themselves every now and
then, they seem to create themselves too. the file gets
created in c:\windows\system32\, and the filename consits
of 6 random numbers, followed by '_up.exe', example,
27166_up.exe
I don't like the sound of this, after a while of these
exes running they seem to jam the internet, i have to end-
task them in order to fix the problem, what do i do?
Ive had these problems when i visited a strange site i
think, also i think it's caused errors that say a certain
critical file needs to close, then it gives me a
countdown until the computer restarts itself.

 

[Kelly]

Hi Ross,

Rid of it, completely. You may have to end process via Task Manager to do
so, first. In the meantime, run all of these, all of them:

Ad-Aware
http://www.lavasoftusa.com/

Spybot
http://tinyurl.com/btf8

CWShredder (Line 313)
http://www.kellys-korner-xp.com/xp_tweaks.htm

Hijack This
http://www.spychecker.com/program/hijackthis.html

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

 

[Kenrick Fu]

The file "avserve.exe" is a new Sasser worm exploiting the LSASS Buffer
Overrun Vulnerability.
To clean your system, download and install the critical update IMMEDIATELY
from
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

And then use Task Manager to kill the "avserve.exe" process and then delete
the executable from c:\windows\avserve.exe