How to remover sasser virus from sp2 rc1

[st.soh]

hi,
i got this sasser virus but can't detect it.
run most cleaner tools from all type of anti-virus, still came out with
nothing (even from microsoft.).

try to do security patch but can't do any update cos it will say already
have newer file.

tried all recommended methods and still after awhile with internet
connections, it will shutdown prompt for LSA error and shutdown in 60 secs.

please help how to solve this problem.

thanks.

 

[st.soh]

hi all,
managed to clear the virus myself n i thought it was sasser, it's not.

after trying so many virus scan n came out with nothing, still i do know
there r virus lugging on my system.

so one last try when into safe mode n started of with fxsasser removal tool
from symantec(no sasser detected), ms sasser remover tool(nothing), avast
detected two worms(w32.sdbot.j) delete two files rasmngr.exe n tfpt3535.exe
..

next go to regedit n clear
hklm>softwware>microsoft>windows>currentversion>run
or runonce
or runservice n other locations.

clear the above entry if found.

restart system n problem solved.

thankx to all but i had myself........

 

[Matt Gibson]

I would format and reinstall your system.

You've had a trojan on there, and you can never be sure you've got
everything.

-Matt

 

[Joe]

Have you tried booting from your antivirus CD ROM then scan your hard drive
in DOS or PC DOS mode?
Joe

 

[madmax]

Have you tried booting from your antivirus CD ROM then scan your hard drive
in DOS or PC DOS mode?
Joe

also to stop shutdown,open run,type shutdown -a ,then enter.
To create a bat file to do this use notepad

@echo off
:loop
shutdown -a
goto loop

save as stayon.bat on desktop. (found instructions on newsgroup)
-max

--
To help you stay safe see: http://www.geocities.com/maxpro4u/madmax.html
This message is virus free as far as I can tell.
Change nomail.afraid.org to neo.rr.com so you can reply
(nomail.afraid.org has been set up specifically for
use in Usenet. Feel free to use it yourself.)