What are the Symptoms of the Sasser worm?
You’ll see a screen similar to the one below when you are infected, this will countdown to zero and literally shut down the system completely. The warning will state “This shutdown was initiated by NT AUTHORITY\SYSTEM”. The message will state that the system process lsass.exe terminated unexpectedly. The message may be prefaced by another message: You can disable this shutdown by following the steps below during the countdown • Click on Start, Run • Type in CMD and press ENTER • Type in the following command and press Enter SHUTDOWN -A This will terminate the shutdown, however in most cases the system may be to unstable to try to recover and may need to be rebooted anyway. How Does Sasser Infect My Computer? When W32.Sasser.Worm runs, it does the following: 1) Attempts to create a mutex named Jobaka3l and exits if the attempt fails. This ensures that no more than one instance of the worm can run on the computer at any time. 2) Copies itself as to the %Windir% directory. This is usually
