Do i have sasser worm? Panda screwed up my PC...

[Guest]

Greetings!

I am having multiple computer issues, and I was hoping that some of the
windows savvy folks in this group might have some suggestions.

My PC was working fine, then all of a sudden it started to restart itself at
random. I asked around and was told that this was probably the "sasser worm".

I went to the microsoft website, and it said the first thing i should do is
to install a firewall ASAP. So I downloaded the trial version of Panda
Titanium.

Then I used the "sasser detection and removal tool" on the microsoft
website, but when I clicked it it said that my computer was NOT infected?

What's more, since I have installed the panda firewall, my system has become
rediculously slow. I mean, I click the start menu and then go away and wait
7-10 minutes for that to appear, then i click control pannel and wait another
15 minutes for that to open.....Needless to say that my efforts to "end task"
or "uninstall" panda have not been successful. It takes so long, that my
computer does the random restart thing before I can get to any of those.

So now i still have the sasser restart thing that isn't really sasser(i'm
still thinking it is?), and the panda firewall has taken my system hostage.

ALL advice appreciated!

 

[George Hester]

I believe Panda runs as a service. See it in Start | Settings | Control Panel | Administrative Tools | Services | find it in there | double-click | and set Startup type to Manual and reboot. Once you get back in check that the service is not running. If it is do the same thing but set Startup type to disable. Reboot. You may get a Service error message at boot ignore it we can attack that later. See if you can uninstall it now. If not reinstall it | Set the service to disable | reboot | try to uninstall again. Let me know how that goes.

 

[Chris]

As far as I can make out (& although it may seem picky, it is an important
distinction) Panda Titanium does not include a firewall. It is antivirus
software which will scan your PC for signs of virus infections, not restrict
network access to your PC from the internet as a firewall does.

You can experience SASSER worm attacks even if you don't have the virus
yourself. This is due to an attacker (probably another infected PC) causing
a 'buffer overrun' in your LSASS.EXE (Local Security Authentication Server
Service). This then results in a shutdown on your PC & the all too familiar
'your PC will shutdown in xx seconds' messages.

Download Zonealarm firewall (free):

http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=zaskulist_download

or similar to secure your connection to the internet, then get the KB835732
patch from Windows Update (Start\Windows Update) which will stop it
happening again.