sasser worm

[nopieees]

i ve 2000 server infected by something similar to sasser worm .
when ever i plug the network cable the server shows me a pop up telling me that the server will restart after one minute .
when i unplug the cable out it works fine .

here is the pop up text
system shutdown

this system is shutting down please save all works in progress and logoff.any unsaved changes will be lost.this shutdown was initiated by autority\system.

time

the system process
C:\wintnt\system32\services.exe terminated unexpectly with status code 128.
the system will shutdown now and restart.

i searched the web for this text and i found this page http://www.pchell.com/virus/sasser.shtml which is giving same details but i couldnot find the .exe files so i think this is a new threat.
please if anyone faced the problem before advise me .

[siljaline]

This tool (http://support.microsoft.com/kb/841720) should help you.

[Marcos]

Sasser is a pretty old worm. It's crucial to install the appropriate hotfix issued by MS to prevent it from spreading over network. However, rather than installing only that particular hotfix you'd better install Windows 2000 SP4 and ALL available hotfixes as they are vital for malware prevention.

[PaulB2005]

Not always caused by Sasser worm.

See also here (http://support.microsoft.com/kb/318447)

[siljaline]

-{ Quote: "Sasser is a pretty old worm. It's crucial to install the appropriate hotfix issued by MS to prevent it from spreading over network. However, rather than installing only that particular hotfix you'd better install Windows 2000 SP4 and ALL available hotfixes as they are vital for malware prevention." }-Agreed, Marcos, that Sasser is quite the old worm.
My thinking is that the OP should clean his/her current installation before going forward and upgrading the OS.