The best way to clear "Sasser"___Introduction to the method of deletion under DOS - China DOS Union Forum

Recently, the Slammer virus has invaded in large numbers. Today I received several users' calls, and it turned out that they all got infected. How to remove it? In fact, this virus is very easy to remove. At this time, DOS is needed. Follow me:
　　1. Boot into the DOS environment using a DOS system boot disk (it is recommended to use a CD - boot). If it is the NTFS format, you also need to load the DOS4NTFS software. Of course, it is best to use the boot disk in this forum. Then the prompt A:\> appears.
　 A:\>C:\
　 C:\>
　　CD C:\windows (or CD c:\winnt (when the OS is NT or 2000))
　　2. Find the "msblast.exe" virus file in the directory.
　　C:\Windows>dir msblast.exe /s/p
　　3. After finding it, enter the folder where the virus is located, and then directly delete the virus file.
　　Del msblast.exe　　
　　The above - underlined parts are the characters input by the user with the keyboard!
Then restart again, and there will be no virus. Finally, remember to download the Microsoft patch!!!

In this way of speaking, then it shouldn't be difficult to design a "Blaster" special-kill tool. Isn't it just about finding and deleting!

Still, people are scarier

A large number of people are using this vulnerability to launch intrusions

Is there any relevant material mentioned by the person above? Let me have a look?

C:\>cd winnt

C:\WINNT>del msblast.exe

C:\WINNT>md msblast.exe

C:\WINNT>attrib msblast.exe +r +h +s

Okay, this virus will never infect again...

This virus is not difficult to remove. It's just that when it attacks, most users don't know what to do. At this time, DOS will show its powerful use. Hehe

The following is a quote from Red Fantasy on 2003-8-15 9:41:34:
In that case, it shouldn't be difficult to design a "Sasser" special killer tool. It's just about finding and deleting!

If it's a tool under WINDOWS, we need to consider whether there is a process of this virus in memory and how to terminate that process
Also, we need to carefully study whether it has modified other system settings. It doesn't matter if it's for personal use, but when making a tool, we need to consider leaving no garbage

Okay, I don't understand. But my machine doesn't know what virus it is. Just can only open the first-level page, and the second-level page can't be opened.

I don't understand.
But my computer doesn't know what virus it is.
Just can only open the first-level page, the second-level page can't be opened.

Is that a virus? It seems to be a problem with your network.. hehe

Under Windows, it can be manually killed, which is very simple, and now the latest versions of all antivirus software can kill this virus!

Quote from iceboy on 2003-8-16 17:25:10:
Is that a virus? It seems to be a problem with your network..? hehe

It seems to be a virus issue.
It seems to be caused by the RPC service being shut down.
I don't know for sure.

^_^I checked it!
There is no such virus in my computer!
^_^

I think my XP might have been infected. Is it the one with a countdown to shutdown?

Mine doesn't seem to be. But for some reason, it restarts after a one-minute countdown once it's connected to the internet.

Floor1　禅宗	Posted 2003-08-14 00:00
元老会员　Posts 300　Credits 1,019　From 广东
Recently, the Slammer virus has invaded in large numbers. Today I received several users' calls, and it turned out that they all got infected. How to remove it? In fact, this virus is very easy to remove. At this time, DOS is needed. Follow me: 　　1. Boot into the DOS environment using a DOS system boot disk (it is recommended to use a CD - boot). If it is the NTFS format, you also need to load the DOS4NTFS software. Of course, it is best to use the boot disk in this forum. Then the prompt A:\> appears. 　 A:\>C:\ 　 C:\> 　　CD C:\windows (or CD c:\winnt (when the OS is NT or 2000)) 　　2. Find the "msblast.exe" virus file in the directory. 　　C:\Windows>dir msblast.exe /s/p 　　3. After finding it, enter the folder where the virus is located, and then directly delete the virus file. 　　Del msblast.exe　　　　The above - underlined parts are the characters input by the user with the keyboard! Then restart again, and there will be no virus. Finally, remember to download the Microsoft patch!!!

Floor2　红色狂想	Posted 2003-08-15 00:00
金牌会员　Posts 1,501　Credits 4,289　From 河南省
In this way of speaking, then it shouldn't be difficult to design a "Blaster" special-kill tool. Isn't it just about finding and deleting!

Floor3　imp	Posted 2003-08-15 00:00
银牌会员　Posts 309　Credits 1,001
Still, people are scarier A large number of people are using this vulnerability to launch intrusions

Floor4　红色狂想	Posted 2003-08-15 00:00
金牌会员　Posts 1,501　Credits 4,289　From 河南省
Is there any relevant material mentioned by the person above? Let me have a look?

Floor5　iceboy	Posted 2003-08-15 00:00
银牌会员　Posts 512　Credits 1,681
C:\>cd winnt C:\WINNT>del msblast.exe C:\WINNT>md msblast.exe C:\WINNT>attrib msblast.exe +r +h +s Okay, this virus will never infect again...

Floor6　禅宗	Posted 2003-08-15 00:00
元老会员　Posts 300　Credits 1,019　From 广东
This virus is not difficult to remove. It's just that when it attacks, most users don't know what to do. At this time, DOS will show its powerful use. Hehe

Floor7　LanE	Posted 2003-08-15 00:00
银牌会员　Posts 648　Credits 1,835
The following is a quote from Red Fantasy on 2003-8-15 9:41:34: In that case, it shouldn't be difficult to design a "Sasser" special killer tool. It's just about finding and deleting! If it's a tool under WINDOWS, we need to consider whether there is a process of this virus in memory and how to terminate that process Also, we need to carefully study whether it has modified other system settings. It doesn't matter if it's for personal use, but when making a tool, we need to consider leaving no garbage

Floor8　ko20010214	Posted 2003-08-16 00:00
版主　Posts 1,628　Credits 7,296
Awesome!

Floor9　lianglimin	Posted 2003-08-16 00:00
初级用户　Posts 9　Credits 139
Okay, I don't understand. But my machine doesn't know what virus it is. Just can only open the first-level page, and the second-level page can't be opened.

Floor10　iceboy	Posted 2003-08-16 00:00
银牌会员　Posts 512　Credits 1,681
I don't understand. But my computer doesn't know what virus it is. Just can only open the first-level page, the second-level page can't be opened. Is that a virus? It seems to be a problem with your network.. hehe

Floor11　hhhhhh	Posted 2003-08-16 00:00
初级用户　Posts 156　Credits 516
Under Windows, it can be manually killed, which is very simple, and now the latest versions of all antivirus software can kill this virus!

Floor12　ko20010214	Posted 2003-08-16 00:00
版主　Posts 1,628　Credits 7,296
*Quote from iceboy* on 2003-8-16 17:25:10:** Is that a virus? It seems to be a problem with your network..? hehe It seems to be a virus issue. It seems to be caused by the RPC service being shut down. I don't know for sure.

Floor13　沈洁	Posted 2003-08-16 00:00
金牌会员　Posts 1,812　Credits 4,590　From 上海市
^_^I checked it! There is no such virus in my computer! ^_^

Floor14　柏仔	Posted 2003-08-17 00:00
初级用户　Posts 100　Credits 478
I think my XP might have been infected. Is it the one with a countdown to shutdown?

Floor15　柏仔	Posted 2003-08-17 00:00
初级用户　Posts 100　Credits 478
Mine doesn't seem to be. But for some reason, it restarts after a one-minute countdown once it's connected to the internet.