Teach you to quickly identify "Sasser"

May 1 Jing Xian Internet "Sasser (Worm.Sasser)" menacing viruses, the virus is through Microsoft's latest high-risk vulnerability-LSASS vulnerability (MS04-011 bulletin Microsoft) spread, the danger of great current WINDOWS 2000/XP/Server 2003 operating system users such as the existence of the vulnerability, users of these operating systems as long as an Internet, there may be the virus attacks. Teach users how to quickly identify the following "Sasser (Worm.Sasser)" virus.

If the user's computer is one of the following phenomena, then that has been poisoned, they should take immediate measures to eliminate the virus.

First, a system error dialog box appears

Attack of the user, if a virus attack fails, the user's computer will appear LSA Shell service exceptions box, and then restart the computer after a minute there the "System Shutdown" box.



Second, a corresponding record in the system log

If the user can not determine whether there had their own computer box above exception or system reboot prompt, you can also view the system log of the way to ascertain whether the poisoning. Method is to run the Event Viewer program, see which system log, if logging as shown below, the proof has been poisoned.



Third, the system resources are a large number of occupation

Virus A successful attack will take up a lot of system resources, so that 100% CPU utilization, appears the phenomenon of the computer running unusually slow.

Fourth, there is named in memory of the process avserve

Virus A successful attack will generate in memory process called avserve.exe, users can use Ctrl + Shift + Esc approach called "Task Manager" and then see if there is a memory in the process of the virus.

5, appears in the system directory file named avserve.exe virus

Virus if the attack is successful, the system installation directory (default is C: WINNT) generated under a virus file named avserve.exe.

6, the virus appears in the registry key

Virus A successful attack would create a registry entry HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun virus key: "avserve.exe" = "% WINDOWS% avserve.exe".






Recommended links:



ASPECT-ORIENTED (AOP) and object-oriented (OOP) [3]



video FORMATS



Archos youtube



Jobs: Find A Good Quality Of The Work Of Eight Major



Storage Genealogy



Infomation Cursors And Fonts



Ps3 avchd



avi APPLE



MMS can Replace SMS?



The insider denied that LEE was a man left and the black about Baidu



How to set up RAID SATA and SAS disks



IM: Decisive Force's crowded



IDC how to charge only Reasonable



Master is not highly educated does not mean that HIGH-INCOME elite



Directory ASP And PHP



Intermediate hospital "backward" sample