http://securityresponse.symantec.com/avcenter/FxSasser.exe
2. Save the file to a convenient location, such as your downloads folder or the Windows desktop, or removable media known to be uninfected.
3. To check the authenticity of the digital signature, refer to the "Digital signature" section later in this writeup.
4. Close all the running programs before running the tool.
5. If you are on a network or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
6. If you are running Windows Me or XP, then disable System Restore. Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details.
Caution: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
7. Do one of the following:
If you are running Windows NT/2000/XP, skip to step 8.
If you are running Windows 95/98/Me, restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."
8. Double-click the FxSasser.exe file to start the removal tool.
9. Click Start to begin the process, and then allow the tool to run.
10. Restart the computer.
11. Run the removal tool again to ensure that the system is clean.
12. If you are running Windows Me/XP, then re-enable System Restore.
13. Run LiveUpdate to make sure that you are using the most current virus definitions.
Note: The removal procedure may not be successful if Windows Me/XP System Restore is not disabled as previously directed, because Windows prevents outside programs from modifying System Restore.
When the tool has finished running, you will see a message indicating whether W32.Sasser infected the computer. In the case of a removal of the worm, the program displays the following results:
Total number of scanned files
Number of deleted files
Number of repaired files
Number of terminated viral processes
Number of fixed registry entries
Hope this helps anyone that might get it. I know I didnt include step one...but step one is to download the removal tool and since I have already included the link, I figured I didnt have to put in step one
Tom