Strange thing happening

  • Zormac
  • Born
  • Born
  • Zormac
  • Posts: 1
  • Loc: Brazil

Post 3+ Months Ago

Ok people, first of all let me introduce myself I am Gustavo 20y.o from Brazil.

I read everything I found on Sasser, in this forum and other places. I went to Symantec website, McAfee, AVG and others, I ran 3 types of AVs, Stinger fix tool, Symantec fix tool, downloaded the update for windows and my computer isn´t running any strange program. I checked the registry for any strange occurances on the Run tab, but nothing strange in system start up. I remembered to turn off the System Restore.

Well, I think I did everything that was told to get rid of Sasser. Believe me or not, the god damn windows accusing error on lsass.exe (which I tried in vain to restore from the Windows CD after a while) keeps getting knocked out and the awfully unpleasent screen NT AUTHORITY\SYSTEM etc etc etc windows keeps showing up (with a funny bug, instead of the normal countdown of 60 seconds it shows something like 29442 days, but turns off in 60 seconds).

It isn´t Blaster, either.

I am getting sick of this problem... I can´t find a way of removing this worm. Will I have to format my HD? Please someone help.

Zormac.
  • DuckIT
  • Graduate
  • Graduate
  • User avatar
  • Posts: 155
  • Loc: London, UK

Post 3+ Months Ago

Basically if nothing in <a href="counter/exit.cgi?http://www.ozzu.com/mswindows-forum/sasser-virus-info-lsass-exe-terminates-with-error-code-t24247.html" target="_blank" class="postlink">this thread</a> helps, then the short answer seems to be yes you have to reinstall.

I wish I knew exactly what file(s) Sasser screws up. When I had it on a clients machine I even tried an in-place upgrade. This basically chucks a new copy of XP over the old one and not even that cured it! Only way I sorted it was a complete format/reinstall (in this circumstance the machine was in a reboot loop - it did not even make it to the desktop.

You can try this link. I haven't tried it or even read it through properly, but I noticed it the other day and this website has very good technical info so it may help: <a href="counter/exit.cgi?http://www.blackviper.com/AskBV/tech10.htmml" target="_blank" class="postlink">Blackviper LSASS info</a>

S

Post Information

  • Total Posts in this topic: 2 posts
  • Users browsing this forum: No registered users and 18 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
 

© 1998-2014. Ozzu® is a registered trademark of Unmelted, LLC.