Sasser-Recovery Update your Windows and download firewalls and anti-viruses. A computer that is infected with the sasser virus will constantly shut down and in order to prevent this one should

1. Click on Start, Run 2. Type in CMD and press ENTER 3. Type in the following command and press Enter -SHUTDOWN –A

This will complete the shutdown, but in most cases the system might be too unstable to recover and will need rebooting anyways. Then this is what you must do:

1. Disconnect your computer from the local area network or Internet 2. Terminate the following running programs avserve.exe avserve2.exe skynetave.exe any process running with the "_up.exe" suffix 3. Close Task Manager 4. Activate the Windows XP or any other firewall/anti-virus to prevent the worm from shutting your system down while downloading patches.

If your computer is still infected you may need to call an IT person to help get rid of the virus.

Netsky-Removal You can download and run the Symantec tool that you can find over the internet

Worm.Win32. can also be removed manually, follow the steps:

1. With all programs closed, click the Start Menu and go to the Control Panel. 2. Locate the Add/Remove Programs icon and double click it. 3. Locate Worm.Win32.Netsky in the list of programs. If you find it, select it and remove it. If you cannot find Worm.Win32.Netsky, you can continue to step 5. 4. Restart your computer. 5. Close all open programs and windows on your desktop. 6. Open your registry editor program by going to Start Menu, type in regedit, and click OK. 7. Find all of the following registry entries and delete them. 8. Delete all files that are associated with Worm.Win32.Netsky from your computer.

9. After locating and deleting the files you must remove all directories associated with Worm.Win32.Netsky by going to the C:\ProgramFiles\Worm.Win32.Netsky folder, select it, and delete it. In some cases you may not be able to find this directory. You can still continue to the next step.

10. Restart your computer. If you find that Worm.Win32.Netsky is still on your computer, you

The Sasser worm was named as such because it spreads in the computer component known as LSASS. Netsky's name comes from the fact that when it was first released, many people were affected and it "flew through the internet and affected many." The Sasser worm first appeared in PC’s on April 30, 2004. Unlike Jaschan’s other virus, the Sasser virus spread through vulnerable systems. This worm ran on Windows 95/98 but did not infect them directly. It would scan the Internet for computers with the security flaw and then insert itself into it. Once the systems were infected it would instruct them to download the worm, changing the victim’s operating system completely. The victim would be unable to shut down their computers unless they unplugged the computer. The sasser worm is unique because it does

Netsky first appeared in PC’s on February 18, 2004. This worm works by spreading through e-mails. Once the victim has opened up the e-mail attachment, the worm will scan all e-mail addresses on that computer and send an e-mail containing the worm to them. This is how the worm spreads, there are also many versions of the Netsky worm.

Sven Jaschan is a German citizen, who was only 17 when he created the Netsky and Sasser worms. Microsoft put out a bounty of a quarter of a million for the creator of the viruses, which led some people to point fingers at Sven. His classmates, whom he had bragged to about the incident, were supposedly the ones who tipped off Microsoft. Sven pleaded guilty in court and admitted to writing the viruses. Since he was a minor at the time, he received a 21 month suspended sentence in order to discuss his sentence which turned out to be three years’ probation and 30 hours of community service. A couple months after the trial, a

The two viruses were pretty effective. At one time, it was believed that the Netsky worm and other viruses derived from the original, accounted for a quarter of all the computer viruses on the internet. The Sasser worm caused a news agency to have its satellites blocked for a couple of hours and a flight company to cancel a few flights, because their computer systems were down. A Nordic bank and insurance company had to close down over a hundred of their offices and the UK Maritime and Coastguard agency had their head office as well as other regional offices hit by the worm. The Taiwan national post office were forced to have a third of their offices revert to pen and paper. Both the viruses cause