Sasser worm and MS04-011

[Joyce Heflin]

I've read all the posts. My problem is that the worm
shuts down my system before I can get the patch (KB835732)
from Microsoft and get it installed. I have followed
Norton manual steps to remove the worm, but after I
reboot and connect to the net, it pops up again. How
have other people gotten around this problem? I think I
might try getting a friend to put the patch (it's over 5
MB) on a CD and run it from there.

 

[Trafton]

Hi Joyce,

In order to prevent restarting during the process, go to the Start menu and
then Run and type "shutdown -a" without the quotes.

Hope this helps. If it doesn't, feel free to post back.

Sincerely,
Benjamin "Trafton" Johnstone-Anderson
Microsoft MVP - Windows Security
Remove "SPAM" from email address to reply!
Security Manifest: www.msmvps.com/trafton/

 

[Guest]

Well... I tried shutdown -a as a run command and got the
error message that the file shutdown could not be found.
I did a search for shutdown and found nothing. What am I
doing wrong?

 

[Andrew Mitchell]

Well... I tried shutdown -a as a run command and got the
error message that the file shutdown could not be found.
I did a search for shutdown and found nothing. What am I
doing wrong?

Are you sure you have the Sasser worm? As far as I know Sasser does not
shutdown your computer. This sounds more like blaster or one of its variants.

Exactly what does the message say when your PC is being restarted?

One thing you might try (but you will have to be fairly quick at doing this)
is to click Start, then Run then type 'services.msc' and click OK.
In the window that appears, find and double-click the Remote Procedure Call
(RPC) Service (*NOT* the RPC Locator).
In the properties for the service, select the 'Recovery' tab and change the
settings to read "Restart the service" for 1st, 2nd and subsequent failures.

Andy.