Friend possibly infected by Sasser

I have a friend who says his computer which runs XP gives him a 60 second countdown then reboots itself. It only does this when he's online. If he doesn't go online, it's OK. Does Sasser only reboot a computer when it's online, or does it do it any time? If it's not Sasser, are there any other worms out there that only reboot a machine while it's online?

 

This sounds exactly like Sasser.

The solution is quick and easy: - put the Microsoft update (from here) and the stinger tool (from here) onto a CD and give it to your friend, as he wont be able to connect to the net for long enough to download them for himself.

He should apply the MS patch first and then run the stinger tool and all should be well.

I have removed sasser from 4 machines using this method.

Hope this helps

 

I don't have any blank CDs. Would they fit on a floppy?

 

Stinger is only 753Kb so it will fit on a floppy, the MS update is 2647 KB
so you will have to split it somehow. I think Winzip does this now, but if not, there are freeware programmes that will do.

 

Very possible that he/she isn't infected yet and only needs to enable a firewall to stop the shutdown. Attack attempts will shut it down too. Still needs to get the patch though!

 

Yeah I'll find something to split the patch.