Editing Sasser (computer worm) (section)

== Removal ==
The Sasser worm can be removed by pressing start and using the '''Run''' command to enter <code>shutdown /a</code>. This will abort the shutdown caused by the termination of lsass.exe, allowing the user more time to remove the worm. The worm may be removed by running <code>regedit.exe</code> and navigating to <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code>. There, the user must remove the <code>avserve2.exe</code> string. Next, the user must terminate <code>avserve2.exe</code> in task manager. Next, the user must navigate to <code>C:\</code> and delete <code>win2.log</code>. Finally, the user must navigate to <code>C:\Windows</code> and delete <code>avserve2.exe</code> and reboot. After a reboot, the user's PC will no longer be infected with Sasser.