Windows XP Embedded infected with Sasser Virus

[David Porter]

Does anyone have any advice on how to remove this virus
from my Windows XP Embedded systems.

Hurdles run into so far:
- My OS is in need of many critical updates.
- My system is rebooting about every 2 minutes leaving
me little opporunity to update the system.
- I have not found a cumulative update (Service Pack) on
the Microsoft Windows XP Embedded website.
- There is no Safe Mode functionality (F8) to use to
prevent the reboot. This method was very successful with
my Windows XP Profressional systesm
- Downloaded the Windows XP Embedded version of the
Sasser patch (KB835732) but it will not install, I keep
getting a QFE install error.

 

[Doug Hoeffel]

David:

Try to stop the rebooting by using "shutdown -a".

Also, google for MS04-011 and avserv for help in trying to remove the virus
once you stop the rebooting.

HTH... Doug

 

[David Porter]

Doug,

Thanks. I downloaded the Win XPE version of the patch
but it will not install. I receive the following error.

"QFE Installer Error. WEUpdate cannot retriece
information need for setup[ from databse. Setup cannot
continue."

I noticed on the update pages a notice stating "THESE
PATCHES ARE FOR THE DEVELOPMENT DATABASE, NOT THE
INSTALLED IMAGE" which is probably why I can't update the
system. How the hell, do you update a deployed system?

However, to allay the problem temporarily I used the
information found on Microsoft's Security page
(http://www.microsoft.com/security/incident/sasser_printxp
..asp)

The systems are running with no incident so far but I
still can't run any of the security or critical patchs on
the systems as I get the same error for each of update.
If you can't tell I'm not an Win XP Embedded pro. I'm an
end user using the software for kiosks.

 

[KM]

David,

Does anyone have any advice on how to remove this virus
from my Windows XP Embedded systems.

Hurdles run into so far:
- My OS is in need of many critical updates.
http://msdn.microsoft.com/embedded/downloads/xp/critQFE/default.aspx

- My system is rebooting about every 2 minutes leaving
me little opporunity to update the system.
- I have not found a cumulative update (Service Pack) on
the Microsoft Windows XP Embedded website.
http://msdn.microsoft.com/embedded/downloads/xp/critQFE/default.aspx

- There is no Safe Mode functionality (F8) to use to
prevent the reboot. This method was very successful with
my Windows XP Profressional systesm

Safe Mode is not supported on XPe.

- Downloaded the Windows XP Embedded version of the
Sasser patch (KB835732) but it will not install, I keep
getting a QFE install error.

Check out Additional_Info_Q835732.RTF document at the bottom of this page:
http://www.microsoft.com/downloads/...d3-3382-4f84-a486-f0d7dffcf01f&displaylang=en

 

[Doug Hoeffel]

David:

The patch you are trying to run is the one for updating Target Designer at
development time. Also, you can't load a Win XP Pro patch on XPe.

You need to run the DUA patch on your deployed images. Since you are a end
user, it seems that this patch should be given to you by whoever built the
image. Hopefully DUA was built into this deployed image.

HTH... Doug

Doug,

Thanks. I downloaded the Win XPE version of the patch
but it will not install. I receive the following error.

"QFE Installer Error. WEUpdate cannot retriece
information need for setup[ from databse. Setup cannot
continue."

I noticed on the update pages a notice stating "THESE
PATCHES ARE FOR THE DEVELOPMENT DATABASE, NOT THE
INSTALLED IMAGE" which is probably why I can't update the
system. How the hell, do you update a deployed system?

However, to allay the problem temporarily I used the
information found on Microsoft's Security page
(http://www.microsoft.com/security/incident/sasser_printxp
.asp)

The systems are running with no incident so far but I
still can't run any of the security or critical patchs on
the systems as I get the same error for each of update.
If you can't tell I'm not an Win XP Embedded pro. I'm an
end user using the software for kiosks.

-----Original Message-----
David:

Try to stop the rebooting by using "shutdown -a".

Also, google for MS04-011 and avserv for help in trying to remove the virus
once you stop the rebooting.

HTH... Doug



.

 

[dp200004]

Doug,

Thanks so much. I've just been given the DUA patch by
the internal staff who developed the imagel. Thanks for
your help!

-----Original Message-----
David:

The patch you are trying to run is the one for updating Target Designer at
development time. Also, you can't load a Win XP Pro patch on XPe.

You need to run the DUA patch on your deployed images. Since you are a end
user, it seems that this patch should be given to you by whoever built the
image. Hopefully DUA was built into this deployed image.

HTH... Doug

Doug,

Thanks. I downloaded the Win XPE version of the patch
but it will not install. I receive the following error.

"QFE Installer Error. WEUpdate cannot retriece
information need for setup[ from databse. Setup cannot
continue."

I noticed on the update pages a notice stating "THESE
PATCHES ARE FOR THE DEVELOPMENT DATABASE, NOT THE
INSTALLED IMAGE" which is probably why I can't update the
system. How the hell, do you update a deployed system?

However, to allay the problem temporarily I used the
information found on Microsoft's Security page
(http://www.microsoft.com/security/incident/sasser_printxp
.asp)

The systems are running with no incident so far but I
still can't run any of the security or critical patchs on
the systems as I get the same error for each of update.
If you can't tell I'm not an Win XP Embedded pro. I'm an
end user using the software for kiosks.

-----Original Message-----
David:

Try to stop the rebooting by using "shutdown -a".

Also, google for MS04-011 and avserv for help in

trying
to remove the virus

once you stop the rebooting.

HTH... Doug
Does anyone have any advice on how to remove this virus
from my Windows XP Embedded systems.

Hurdles run into so far:
- My OS is in need of many critical updates.
- My system is rebooting about every 2 minutes leaving
me little opporunity to update the system.
- I have not found a cumulative update (Service

Pack)
on

the Microsoft Windows XP Embedded website.
- There is no Safe Mode functionality (F8) to use to
prevent the reboot. This method was very successful with
my Windows XP Profressional systesm
- Downloaded the Windows XP Embedded version of the
Sasser patch (KB835732) but it will not install, I keep
getting a QFE install error.



.

.