Thank you for your e-mail.
If this is only happening when you are on the Internet, you should first enable the XP firewall to prevent yourself from getting infected again when you go back online.
Now you need to update your machine. This, however, requires that you connect to the Internet to do so, and your computer will restart itself. What you can do is before going online, go to Start->Run... and type "shutdown -a" without the double quotes and don't click OK. Go on the Internet, and when the auto shutdown message appears, click on the OK button for the Run... command. This will cancel the shutdown.
Now you can continue on to get rid of the virus and patch your computer. I'd recommend removing the virus before installing the patch; you can restart after removing it and won't have to worry about the forced shut downs. Symantec's removal tool doesn't require the patch be installed first so I'd use that one. Then Windows Update everything and you should be ok.
So lots of talk into quick steps:
- Firewall the machine.
- Go on the Internet and stop the auto shutdown.
- Remove the virus.
- Restart.
- Install all patches Windows Update says to install.
This should remove the virus and protect you from future infections.
Microsoft has a Web site that deals specifically with the Sasser worm at http://www.microsoft.com/security/incident/sasser.asp--take particular note of the instructions for using the removal tool. It won't work if you have not installed a particular Windows update, and may also have problems running if your security settings are too high.
Another source of information is the Symantec's detailed manual removal instructions at http://securityresponse.symantec.com/avcenter/venc/data/ w32.sasser.b.worm.html. Please note I urge extreme caution on this--if you do not follow the directions exactly you could end up doing more harm than good. Therefore, if you feel at all unsure about doing this on your own, I would definitely suggest bringing your computer into a repair shop.
Once you're back up and running, don't forget to continue to update your antivirus definitions and run the Windows critical updates on a regular basis.
Good luck!
