Help?
I’m running Windows XP, and I keep getting the shutdown and error message that seems to be associated with the sasser worm ("The system process c:\windows\system32\lsass.exe terminated unexpectedly with status code - 1073741819
The system will now shut down and restart’)
But I ran the sasser & sasser.b tools that should restore it and they’re say that the worm isn’t on my system.
Is there anything else that can cause this?
Some of our IT people thought it was W32/Nachi-D, which indeed causes similar effects (the computer boots up, starts Windows, then a dialog box appears and it shuts down in 30 seconds). They even work in similar ways (creating a malicious service, copying an FTP server to %windows%\system and having it masquerade as a system file). The only way to tell is to examine the registry and look for the FTP server file on an infected machine. Recent updates of an antivirus program will find both worms.
60 seconds. Sorry. (Less time than it took to notice my error – and the maximum post frequency on this message board.)
Well, there are .c and .d variants out there now - don’t know if the tools you mentioned will take care of those variants yet or not.
critter42
the warning that you got looks something like the one that i got a few weeks ago. for me, i had this: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=121075#VirusInfo hope this helps.