Hi,
I had a similar experience with the sasser worm and a friend's machine running Windows XP. I went to the Symantec site and pulled the sasser fix in an executable file. This costs nothing and is a fairly quick download 'cause the files are small. You just have to have the bad guy identified as the files are specific to the virus/worm. Then before you run the fix, turn off the Restore feature. That got it.
If the folks in trouble cannot access the web, I pull the fix and put it on a thumbdrive or a floppy, (if they have no USB).
Frank
----- Original Message -----
From: "Jeremy C. Reed" <
reed@reedmedia.net>
To: <
plug-discuss@lists.plug.phoenix.az.us>
Sent: Monday, May 10, 2004 5:54 PM
Subject: Re: restore
> On Mon, 10 May 2004, Craig White wrote:
>
> > I don't recall seeing anything like that in the distro's that I've
> > worked with. This is mostly unnecessary since the the two reasons for
> > this feature are to overcome virus damage or installation damage where
> > an older dll overwrites a newer dll. Even Windows has implemented a
> > method to keep the overwrites from occurring now.
>
> I rarely touch Windows, but in-laws (who used NetBSD and then Linux for a
> year before buying a new computer) needed my help.
>
> They had the sasser worm. I followed the instructions (so I thought) at
> the Microsoft.org website. I did a Windows Update and chose yes to update.
> Then it suggested I needed to restart the system.
>
> So I did.
>
> The system failed to come back up and was missing a DLL. My mouse moved on
> a blank screen but nothing else was shown. Booting to safe mode didn't
> help. Then my Windows friend suggested that I boot using "last known
> configuration" and it worked.
>
> I still had the sasser. Many processes starting faster than I could stop
> them. Anyways, I manually removed the binaries, removed some registry
> startups with regedit, and turned on the Xp firewall. All is well now, I
> guess.
>
> For Linux, this couold probably be easily done a couple ways:
>
> - backup all configs in a tarball (that is dated)
>
> - backup all system commands and libraries
> or alternatively:
> - have a list of installed packages with exact version numbers and
> packages readily available
>
> Then to recover to last known configuration have a script that backups
> broken configuration and overwrites with new.
>
> > I suppose that if you had a corrupted 'package' on Linux, you could do
> > something like 'apt-get -f install package' to put the original binaries
> > back in place.
>
> dpkg can output a list of packages installed and can use same list to
> install. (But --get-selections doesn't seem to have package versions.)
>
>
> Jeremy C. Reed
>
> BSD News, BSD tutorials, BSD links
> http://www.bsdnewsletter.com/
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)