avserve2.exe - Dangerous
avserve2.exe
Manual removal instructions:
Antivirus Report of avserve2.exe:
avserve2.exe
Worm.Win32.Sasser.b
This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service.
The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
http://www.microsoft.com/technet/securit...
When launching, the worm registers itself in the system registry autorun key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avserve2.exe = %WINDIR%\avserve2.exe
The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011.
A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.
Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself.
The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.
To remove this worm you can download free utility from www.kaspersky.com
| avserve2.exe | Malware |
| avserve2.exe | Dangerous |
| avserve2.exe | High Risk |
This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service.
The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
http://www.microsoft.com/technet/securit...
When launching, the worm registers itself in the system registry autorun key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avserve2.exe = %WINDIR%\avserve2.exe
The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011.
A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.
Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself.
The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.
To remove this worm you can download free utility from www.kaspersky.com
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.