Help required - possible worm

You may have the Blaster worm.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may want to run antivirus software that is updated daily and a good firewall to stop things like this (assuming it is the Blaster worm that is the problem, of course).

 

I just ran a scan and it caught 2 of these:

Win32.Apsiv.A worm


Anyone know what that is?

 

I found this info searching the net.

You will have to shut down your system restore to clear your restore points and run the scanner with it off. I had the same issue with an I-worm warning. Also make sure you clear temp internet files as it likes to hide there also. AVG kept giving me warnings until I shut off system restore then scanned. BTW after clearing the restore points and temp files virus scans came out clear of virus (AVG and housecall)


how to disable system restore

Gotta start scanning all that p*rn you're downloading from Kazaa!

 

Here is a good link that describes it in detail and gives good removal instructions.

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.chemsvy.html

 

I got it too. Lousy XP.

It's really easy to get rid of:
http://www.microsoft.com/security/incident/sasser.asp

 

New, Blaster-style Windows worm sweeps the Net

By DWIGHT SILVERMAN
Copyright 2004 Houston Chronicle


Computers using Microsoft's Windows XP or 2000 operating systems are the target of a new Internet worm that spreads from machine to machine without user intervention.

The worm, dubbed Sasser, takes advantage of a flaw in Windows that was patched by a fix issued in mid-April. However, because not all users take advantage of an auto-update feature included in Windows XP and 2000, there are still many systems connected to the Internet that are vulnerable.

Sasser attacks a component of Windows called LSASS.EXE, and installs a file called AVSERVE.EXE, which then begins scanning the Internet and local networks for more machines to infect. Unlike the majority of viruses and worms that attack Windows-based systems, Sasser does not require e-mail to spread.

The worm also creates a server program on the infected computer that uses FTP, a common way to transfer files between computers, potentially leaving it vulnerable to hackers.

An analysis by security software firm Symantec indicates Sasser has the potential to slow an infected PC dramatically, rendering it nearly unusable.

According to McAfee.com, a PC security site operated by Network Associates, the worm may also crash the LSASS.EXE module in Windows.

Sasser is similar to another worm that wreaked havoc among Windows users in 2003. MS-Blast or Blaster worked the same way, taking advantage of unpatched systems and exploiting a flaw for which Microsoft had already offerered a patch.

However, Sasser appears to be moving at a slower pace than Blaster, which reproduced so quickly that it bogged down some Internet servers. Most antivirus software companies today had Sasser rated as a medium-risk worm.

The patch that fixed the flaw Sasser exploits was released April 13.

The use of a hardware or software firewall -- which prevents unauthorized access to a computer on a network -- may also provide some protection to unpatched systems. Most of the major developers of antivirus software have released updates to their products to detect and remove Sasser.

Microsoft has come under increasing fire from computer security experts because its software is ubiquitous and riddled with flaws that allow such attacks.

 

Oh, well then some of us will never see the problem.

 

<a href="http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html">Symantec has a removal tool and more info</a>.