patch 4 autoshutdown worm in win 2003 server

[taken]

hi,

i have recently loaded windows 2003 standerd edition on my server machine and it has been affected by this

"... will shutdown in 60 seconds... win NT/Authority .." XXX worm.

i got a fix only for win XP pro and windows 2000 server. i have tried with windows 2000 server patch on this OS but it say that the OS is not of proper version. pls suggest me the patch URL. i desperately need it.

reg
taken

[digen]

Afaik Win2003 is one amonst the few OS's which doesnt get infected by sasser/blaster worm.But I maybe wrong.

Can you please post the exact error message you are recieving? A screenshot would be of great help.

[rajas]

Sasser Worm will affect WinNT, 2000, XP, Windows Server 2003, Microsoft NetMeeting. (All Versions).


@taken: Check the link for the download patch for WIN Server 2003. Also, it includes the update for all versions of Windows.

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

[digen]

Oh yeah my bad.
Thanks for the info rajas.

[rajas]

ur welcome digen.

[taken]

thnks 4 the Re

i am downloading it. hope that it works out.

taken

[taken]

well well,

i have downloaded the patch but it still exists. is there any remedy or other ways to get this problem out???

regs

[rajas]

Try scanning with Stinger
Stinger is a stand-alone utility used to detect and remove specific viruses
http://vil.nai.com/vil/stinger/

OR
Microsoft® Windows® Malicious Software Removal Tool
http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Both the utilities can clean the computer for Sasser or Blaster Worm/Virus. Try both and post the result.

[taken]

so thnsk of ur prompt re:

well, i have downloaded the S/w both stinger and Microsoft one. Ran both of them and could just get nothing:

here is the report of stinger:
----------------
McAfee AVERT Stinger Version 2.5.3 built on Mar 1 2005

Copyright (C) 2005 Networks Associates Technology, Inc. All Rights Reserved.

Virus data file v1000 created on Mar 1 2005.

Ready to scan for 53 viruses, trojans and variants.



Scan initiated on Wed Apr 20 17:23:41 2005

Number of clean files: 17916



Scan initiated on Wed Apr 20 17:27:42 2005

Number of clean files: 17918
--------------------

to say, i have first just intititated the scan and in it, repair was on. later again i scanned with "report" option enabled.

so, i dont find anything sugesting here.

well, reg the other, it just ran and showed that nothing is corrupted or infected.

so, i think when the scan was on progress, it might have cured the virus. i will have to test the system now again as such.

well, is it that at any point of time this worm reenters the system after the scan??? if then i think i will have to scan each and every time i start the PC. isn't it

pls suggest the feedback
taken

[rajas]

@taken:

The worm hits the RPC services. so, when u clean the traces of the infection and apply the patch, there is no point that it would come back.
If you still get the error of "NT Authority...", its better to reformat. Apply the patch of Sasser/Blaster immediatly B4 u do anything. may be Worm messed-up the RPC Services.