Name : avserve2.exe
Path : %WINDOWS%\avserve2.exe
[ C:\Windows\avserve2.exe ]
Name : W32.Sasser.Worm
Alias : W32/Sasser.Worm,
W32/Sasser-A, Sasser.A, WORM_SASSER.A,
level : Medium
Avserve2.exe is the main
component dropped by Sasser worm. It is a network
Worm, exploits a remote code execution
vulnerability LSASS to infect target systems. It
scans for IP addresses and infects unpatched
systems. This worm targets Windows 2000, and
Windows XP systems. Solo Antivirus can detect and
remove Sasser worm and its variants safely.
Sasser worm copies to
Windows folder as AVSERVE2.EXE. Then it
modifies registry run section to load
automatically on the next startup. The registry
modification is given below.
By default, %WINDOWS% will be C:\Windows in case
of Windows 95/98/ME/XP, C:\Winnt in case of
Windows NT/2000 ]
Sasser worm can be
avoided by installing security patches from
Microsoft. If you have not installed, you can get
a copy at http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx The worm infected users
will receive the error messages like
This system is shutting down. Please save
work in progress and log off. Any unsaved
changes will be lost. This shutdown was
initiated by NT AUTHORITY\SYSTEM
before shutdown : 00:00:59
The system process
terminated unexpectedly with status code 0.
The system will shutdown and restart.
worm infected systems will crash and reboot by
dispalying error in LSASS.exe. This worm appeared
on 30th April 2004.
How can I protect my
Solo has incorporated
Avserve2.exe in its signature file to protect
users from this worm attack. Make sure that you
have installed registered version of Solo
Antivirus to protect your system from all virus
to remove this worm?
If you are already
infected with Avserve2.exe process, download and
install security patches from the link http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx Then run Solo anti-virus
scanner to remove the worm components.
antivirus can detect and remove Avserve2.exe
Use the following link to Download 30 day
trial version of Solo antivirus to
remove viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts, Trojans,
Backdoors, boot sector, partition table and macro
purchase Solo antivirus using the link