FONForum

1.
Create a file called %systemroot%\debug\dcpromo.log and make the file read-only. To do this, type the following command:

echo dcpromo >%systemroot%\debug\dcpromo.log & attrib +r %systemroot%\debug\dcpromo.log

NOTE: This is the most effective mitigation technique as it completely mitigates this vulnerability by causing the vulnerable code to never be executed. This work-around will work for packets sent to any vulnerable port.

2.
• Enable advanced TCP/IP filtering on all adapters to block all un-solicited inbound TCP packets

• Go to Start, Run and type Control and press enter

• In the new Control Panel window double click on Network and Dialup Connections

• Right click on the adapter that is connected to the Internet or the infected network and select Properties

• Double click Internet Protocol (TCP/IP)

• Click Advanced

• Select the Options tab

• Double click TCP/IP filtering

• Check the Enable TCP/IP filtering (all adapters) checkbox

• Select the Permit Only button above TCP Ports

NOTE: Do NOT add any ports to this list and do NOT select the Permit Only button above the UDP Ports label.

• Press OK 4 times and then select Yes when prompted to reboot the system (you must reboot for these settings to take effect)

This is an alternate mitigation technique that can be used to block all attempts to exploit the vulnerability via the TCP protocol. This will not prevent malformed UDP packets from reaching a vulnerable port and does not completely block the vulnerability like the steps outlined above.

3.
Temporarily stop the server service by typing the following command line:

net stop server /y

NOTE: This technique will only block exploit attempts that occur via TCP 139 and 445.

If the machine is currently infected with the Sasser worm it may start flooding the local network connection as soon as the cable is plugged back in making it impossible to download updates. To temporarily disable the worm use Task Manager to kill the following processes:

• Kill any process beginning with 4 or more numbers and “_up.exe” (for example, 12345_up.exe)

• Kill any process starting with avserve (for example, avserve.exe, avserve2.exe)

• Kill any process named skynetave.exe

After stopping the worm processes you should be able to download the security update and a Sasser removal tool.

London -- Kompjuterski virus "Saser", kojim su zaražene neke verzije "Vindousa", i dalje napada šireći se neometano internetom.

Tako su kompjuteri britanske Obalske straže, britanskih avioprevoznika i Nemačke pošte već zaraženi virusom. Kompjuterski eksperti strahuju da će novi talas virusa napasti kućne kompjutere i zbog toga upozoravaju korisnike da dopune neophodne dodatke kojima će zaštititi svoje kompjutere od ovog zloćudnog programa.

Crv "Saser" se pojavio prvi put prvog maja i već je zarazio stotine hiljada mašina, a možda i milion, zavisno od procena. Bez obzira na procene, četiri varijante virusa napravile su već "impresivnu listu žrtava". Prema izvještaju, samo u Nemačkim poštama inficirano je 300 hiljada kompjutera, tako da osoblje pošte više nije u stanju da vrši novčane uplate i isplate.

Mašine u Investicionoj banci Goldman Saks, Evropskoj komisiji, britanske Pomorske obalske straže, britanskog avioprevoza su žrtve virusa. Žrtve su i Tajvanska pošta, hongkoška vladina ministarstva i bolnice, Australijske željeznice i mnogi drugi širom svijeta.

Ričard Arčdikon iz tehničkog servisa firm Simantek koja proizvodi antivirusni softver, kaže da će se za 24 časa videti koliko daleko će se virus proširiti. Do sad je najbrže napravio najveću štetu od bilo kojeg prethodnog virusa.

Virusom mogu biti inficirane i blokirane mašine sa verzijom “Vindous” 2000 i “Iks P”, a verzije “Vindous” 95, 98 i “Milenijum” mogu biti prenosnici, iako same ne mogu imati štetu. Ovaj virus se zove crv zbog toga što je samostalan, sam se kreće kroz mašinu i šalje dalje putem interneta, bez pomoći odnosno učešća korisnika u tome. Virus deluje tako što aktivira mnoštvo programa uzrokujuću zagušenje koje se manifestuje usporavanjem rada, a jedan od efekata je i resetovanje kompjutera, najavljeno i sa tajmerom na dispkeju koji odbrojava sekunde.

“Majkrosoft” i druge bezbednosne firme su već izdale programska oruđa koja pomažu da se virus otkrije i ukloni iz sistema. Tvorci drugih virusa nastoje iskoristiti uspeh "Sasera" i plasirati svoje viruse upakovane kao navodna zaštita i lek za "Saser".

Gde si ti dosad bio ako ovo nisi znao!