Windows Forum

Ask something
Discussion Locked

sasser virus

0 helpful
4 replies

by scvivek_chandra

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

sir/madam
i have an pc at my res which is having the following p4/256mb/2.8Ghz/intel 265GBF M/B and loaded with win2k,office2k,service pack4,6MB patch for Blaster virus and other windows updates from the site(Microsoft site)and norton 2004 with latest updates to my pc the problem is when ever i connect to internet it will say that "windows had found error in the file system it will restart in 60sec" and it do the same. Even i have downloaded an patch for that SASSER virus but its doing the same please help out in this isses

4 replies

by skidoggeruk

Check registry keys in the run box like these

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve3.exe" = C:\WINDOWS\avserve3.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve.exe" = C:\WINDOWS\avserve.exe

You could also try to find and delete/rename these files. Search the whole HDD.

Make sure to check C:\_Restore folder.

To remove this virus "by hand", follow these steps:

Here is what McAfee had to say(for one of the variants) :

Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode

Good Luck

by skidoggeruk

to perform registry edits, you need to run regedit from start/run box. Standard reference to changing registry keys here. (Please be careful.)

by bigkenny

first of all you have disable system restore in
system properties then restart the PC in safe mode (F8 on boot after post screen) select safe mode when windows starts then run the fix tool restart PC go back system properties
and enable system restore hope this helps

This discussion is closed to new replies.