Operating System Information --> Windows XP Information --> Windows XP Security --> Removal Instructions for the Sasser Worm -->

Removal Instructions for the Sasser Worm

Stinger does not appear to remove the Sasser worm. At this time we are recommending the Symantec removal tool located at http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html
Abbreviated removal instructions:

1. Download the FxSasser.exe file from: http://securityresponse.symantec.com/avcenter/FxSasser.exe. Note: Version 1.0.1 (As shown in removal tool dialog title bar) provides support for both W32.Sasser.B.Worm and W32.Sasser.Worm.
2. Close all the running programs before running the tool.
3. If you are on a network or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
4. If you are running Windows Me or XP, then disable System Restore. Caution: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
5. Double-click the FxSasser.exe file to start the removal tool. Click Start to begin the process, and then allow the tool to run.
6. Restart the computer.
7. Run the removal tool again to ensure that the system is clean.
8. If you are running Windows Me/XP, then re-enable System Restore.
9. Update your virus software.
10. Run Windows Update or download the security update from http://www.microsoft.com/security/incident/sasser.asp