UNSOLVED
Sasser
I appear to have acquired Sasser. I'm running XP-Home on a Dimension 4400, with up-to-date McAfee Virusscan and Firewall; however, my Windows upgrades are not up to date because of a major problem I had the last time I updated. I'm getting the standard error message associated with Sasser (lsass.exe terminated unexectedly--you know the routine, I'm sure), but it appears when I first boot up and prevents Windows from starting. For this reason, I can't use any of the usual fixes, which all require the ability to actually run Windows. This happens whether I boot up normally or in Safe Mode.
I haven't been able to find anything that addresses this problem. Can anyone here help? Thanks!
computer_soluti
2 Posts
175
0
Posted June 9th, 2005 19:00
When you start you computerstep1: Go to start then run and type shutdown -a (this will stop your computer from restarting by itself)step2: Go to http://tinyurl.com/5lyxe to download and run the Microsoft Malicious Software Removal Tool. Use this tool to scan your computer.step3:if you are running windows XP - turn on the windows firewall or any software firewall on your computer. If you do not know how to turn on the windows firewall, follow the instruction on http://www.microsoft.com/athome/security/protect/windowsxp/firewall.mspxstep 4: If you are running windows XP turn off the restore point at this point - to avoid reinfection.instruction of how to turn of the restore point are at: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405step 5: Run the Microsoft Malicious Software Removal tool ( http://tinyurl.com/5lyxe) again to make sure that there are no traces of sasser worm.step 6: Update your windows - by going to start then help and support, click on get windows update.step 7: update your antivirus software and run a complete scan.step 8: If you have any antispyware installed - have it updated and run a complete scanstep 10: Now the computer should be clean, then you can reboot or continue with whatever you want to do.Abrandoned
211 Posts
175
0
Posted June 10th, 2005 14:00
Hi janisbeth,
Removing Sasser
Sasser is a worm that spreads itself via the Internet. An unprotected Windows XP machine will get Sasser within just a few minutes of being put on the ‘net. To protect your system run Windows Update at http://www.windowsupdate.com/ regularly and use a firewall (a broadband router will do fine).
To remove the Sasser infection follow these steps:
1. Disconnect from the Internet.
2. Disable Sasser to keep your system from rebooting. Click Start, select Run… and enter shutdown -a then press OK. That will stop the worm.
3. Turn on your Windows XP firewall. Open Network Connections, right-click your network connection icon and select Properties. Click the Advanced tab and turn on the firewall. This will prevent reinfection.
4. Reconnect to the Internet
5. Update your anti-virus and disinfect your computer, or download the free Sasser removal tool from SARC at http://www.sarc.com/avcenter/venc/data/w32.sasser.removal.tool.html
6. Run Windows Update at http://www.windowsupdate.com/ and install all critical updates. You should do this regularly.
MACHADO458
167 Posts
175
0
Posted May 31st, 2005 00:00
Message Edited by MACHADO458 on 07-17-200612:02 AM