sasser virus

[helloman]

novell network
windows 2000
client security

just got a message from internet explorer that computer
was infected with sasser and asked if i wanted to
disinfected it . ( this was not a symatec homepage) the
screen went all blue and a small box appeared in ie asking
me to disinfect computer. I shut the app down. is this
suppose to happen???

 

[drover98]

I don't know if it will help, but I've been going through
hell with this sasser virus. If you want to disinfect,
and you can get to Symantec or Mcafee, go there to do so.
I'm unable to go to those sites - I keep getting page not
found messages - so I went to Microsoft's site and
disinfected there. I still cannot go to Symantec or
Mcafee; I think some remnant of the virus is blocking
those sites. I'm looking for help on that. Good luck!
Tom

 

[Guest]

curious how you found out

did it come on microsoft ie screen or did your antivirus
program found it , my main concerns is this came up
totally in ie not norton

 

[H Leboeuf]

It's not documented by the virus (or a new variant) may create this file
that will redirect you to your computer when going to these sites.
Please confirm to this thread.


It may be a HOSTS file problem.
Look for a file named HOSTS (no extension, could be hidden) rename it
OLDHOSTS.

 

[H Leboeuf]

It's probably a SPAM trying to get you to buy something to do not need.

How to Prevent Windows Messenger from Running on a Windows XP-Based Computer
By default, Windows XP Professional and Windows XP Home Edition install
Windows Messenger, and the user interface does not provide a way to remove
or to uninstall Windows Messenger.
http://support.microsoft.com/?kbid=302089 (4.4, 4.5, 4.6. 9/23/2003)


Messenger Service Window That Contains an Internet Advertisement Appears
A Messenger service window appears that contains an Internet advertisement
that is similar to the following text:
Messenger Service
Message from source to your_computer_name.ISP_name on date time Message Text
http://support.microsoft.com/?kbid=330904 (XP/W2000 11/4/2003)


Stop Messenger SPAM
http://www.spywareinfo.com/articles/spam/messenger.php


Stop Messenger SPAM
The developer of the messenger spam software indicates on their web site
that "these messages are completely anonymous and virtually untraceable.
With this program your IP address never shows up anywhere."
http://www.stopmessengerspam.com/
--

Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm


Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

I too have gotten this thing. its like every once in a while when u go to

open an internet explorer a webpage opens up and it has this message box
saying (WArning!! Sasser_d virus detecte! pres ok to scan and disinfect)
something like that right? the messagebox is not from norton or anything its
a webpage msgbox. i checked the history and i find out the page is

DONT! CLICK!--> http://ads.softwareoutfit.com/doom_alert.php
something like that. I havent been able to find any pattern to why it

occurs. the only thing i remember is that around the same time this started
happening my norton AV had found 3 infected files dealing with suns java i
think they were named a.class, dummy.class and soemthing else with the
byteverify virus. they were quarrentined as soon as they were found.