Sasser on SP2

[Rahosi]

My cousin's almost new IBM PC with XP started loop rebooting on the very tail end of logging in. Yesterday I restored it to 'last week', scanned the system and it was cured. Today it is rebooting again.

This PC is FULLY up to date, with ZA 5.1 Security Suite (Firewall and AntiVirus). SpyBot & Ad-AwareSE Pro. I put SP2 on myself last week. It has a Binatone USB / ADSL internet connection (yuk!) which is continually dropping it's connection. (Could this be caused by the virus or just the useless modem?)

He had removed Ad-Aware as some boffin had told him SpyBot reported it as a virus.

It will boot into SafeMode. Checking the bootlog after enabling it didn't help.

On reinstalling Ad-Aware Ad-Watch queried whether to allow an Avserve32 modification to the registry! SASSER.

I have run virus checks with ZA, Stinger and an on line checker to no avail. I have run MS Sasser tool, SpyBot & Ad-Aware similarly.

From memory I also did the following:-

Manually deleted registry entries
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
"avserve.exe"="%Windir%\avserve.exe"

Deleted Avserve32.exe from the windows directory
Deleted cmd.ftp

I have been loathe to switch off Restore (Do I HAVE to??) as that would bar me from uninstalling SP2.

This thing is hiding itself!

Tomorrow I will try the suggestions on

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html

to stop it rebooting.

Any other suggestions?

 

[Mike2287]

You should shut off the system restore. if you don't it will more then likely show back up

 

[linney]

There are other ways to remove SP2 should you ever have to.

875350 - How to remove Windows XP Service Pack 2 from your computer

http://support.microsoft.com/default.aspx?scid=kb;en-us;875350&FR=1&PA=1&SD=HSCH

875355 - How to use the Automatic Recovery feature to recover your computer if the Windows XP Service Pack 2 Setup program is not completed successfully

http://support.microsoft.com/default.aspx?scid=kb;en-us;875355&FR=1&PA=1&SD=HSCH

329015 - How to Manually Remove Windows XP Service Pack 1

http://support.microsoft.com/default.aspx?scid=kb;en-us;329015&FR=1&PA=1&SD=HSCH

878454 - How to help protect your computer if you decide to remove Windows XP Service Pack 2

http://support.microsoft.com/default.aspx?scid=kb;en-us;878454&FR=1&PA=1&SD=HSCH