Otau Games
1 mai 2004 à 12:56
C'est bien un virus, qui t'empêche d'aller sur le Net entre autre. Pour l'enlever provisoirement voici la marche à suivre et la clé du registre à enlever :
W32.Sasser is a worm that attempts to send code that exploits the MS04-011 vulnerability.
The worm spreads by randomly scanning IP addresses for vulnerable systems.
The presence of the following files is an indication of infection:
%windows%\avserve.exe
The worm then adds one of the following registry values:
"avserve.exe"=%windows%\avserve.exe
To the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The worm opens ftp port 5554, and randomly scans IP addresses for vulnerable systems.
Symantec Security Response is continuing to analyze the worm and will update this page as information becomes available.
