# Something other than Sasser? **URL:** \ **Category:** Factual Questions\ **Created:** [May 4, 2004, 7:15am UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431 "2004-05-04T07:15:51Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![amarinth](https://avatars.discourse-cdn.com/v4/letter/a/3be4f8/32.png) [@amarinth](https://boards.straightdope.com/u/amarinth)\ **Post date:** [May 4, 2004, 7:15am UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431/1 "2004-05-04T07:15:51Z")
Help? I’m running Windows XP, and I keep getting the shutdown and error message that seems to be associated with the sasser worm ("The system process c:\windows\system32\lsass.exe terminated unexpectedly with status code - 1073741819 The system will now shut down and restart’) But I ran the sasser & sasser.b tools that should restore it and they’re say that the worm isn’t on my system. Is there anything else that can cause this? ---
**Author:** ![Roches](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@Roches](https://boards.straightdope.com/u/Roches)\ **Post date:** [May 4, 2004, 12:04pm UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431/2 "2004-05-04T12:04:36Z")
Some of our IT people thought it was W32/Nachi-D, which indeed causes similar effects (the computer boots up, starts Windows, then a dialog box appears and it shuts down in 30 seconds). They even work in similar ways (creating a malicious service, copying an FTP server to %windows%\system and having it masquerade as a system file). The only way to tell is to examine the registry and look for the FTP server file on an infected machine. Recent updates of an antivirus program will find both worms. ---
**Author:** ![Roches](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@Roches](https://boards.straightdope.com/u/Roches)\ **Post date:** [May 4, 2004, 12:05pm UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431/3 "2004-05-04T12:05:48Z")
60 seconds. Sorry. (Less time than it took to notice my error – and the maximum post frequency on this message board.) ---
**Author:** ![critter42](https://avatars.discourse-cdn.com/v4/letter/c/7ba0ec/32.png) [@critter42](https://boards.straightdope.com/u/critter42)\ **Post date:** [May 4, 2004, 12:15pm UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431/4 "2004-05-04T12:15:26Z")
Well, there are .c and .d variants out there now - don’t know if the tools you mentioned will take care of those variants yet or not. critter42 ---
**Author:** ![Capt\_B.Phart](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@Capt\_B.Phart](https://boards.straightdope.com/u/Capt_B.Phart)\ **Post date:** [May 4, 2004, 1:40pm UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431/5 "2004-05-04T13:40:07Z")
[Tool for variations up to d](http://www.f-secure.com/v-descs/sasser_d.shtml) ---
**Author:** ![Aceospades](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Aceospades](https://boards.straightdope.com/u/Aceospades)\ **Post date:** [May 5, 2004, 3:17pm UTC](https://boards.straightdope.com/t/something-other-than-sasser/243431/6 "2004-05-05T15:17:56Z")
the warning that you got looks something like the one that i got a few weeks ago. for me, i had this: [http://us.mcafee.com/virusInfo/default.asp?id=description&virus\_k=121075#VirusInfo](http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=121075#VirusInfo) hope this helps.