Browser Terminates Unexpectedly

[Stacie]

Hi to anyone that can assist me.

My grandmother just got a new PC and everything has been ok with it so far.
It is an HP and running XP Home. She is on dial-up. When she goes to dial
up and gets signed in...she gets the following error message:

c:/windows/system32/sass.exe
Status Code 1073741819

Shutdown Initiated by
NT Authority/System

When that message pops up, her browser just shuts down and she cannot get
on-line.

Does this look somewhat familiar to anyone? Any suggestions or advise would
be greatly appreciated!!

Thanks,
Stacie

 

[Unknown]

She unfortunately got a virus.

 

[Malke]

Hi to anyone that can assist me.

My grandmother just got a new PC and everything has been ok with it so
far.
It is an HP and running XP Home. She is on dial-up. When she goes to
dial up and gets signed in...she gets the following error message:

c:/windows/system32/sass.exe
Status Code 1073741819

Shutdown Initiated by
NT Authority/System

When that message pops up, her browser just shuts down and she cannot
get on-line.

Does this look somewhat familiar to anyone? Any suggestions or advise
would be greatly appreciated!!

Thanks,
Stacie

Actually, it is "sasser" and your grandmother is infected with that
worm. Here is some information to help you help her:

To stop the rebooting, go to Start>Run and type "shutdown -a" without
the quotes. For information about the worm, go here:

http://www.sarc.com/avcenter/venc/data/w32.sasser.worm.html

Get the worm off the system and then immediately patch XP:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx -
TechNet bulletin with download links

Or I believe this has been out long enough now that all the necessary
patches are on Windows Update:

http://windowsupdate.microsoft.com

Install an antivirus program and keep it updated. Install a firewall. XP
has a built-in firewall, or there are free alternatives like Zone Alarm
or Sygate. Be aware that cleanup may be complex - we are now seeing
that infected computers usually have more than one variant of Sasser,
as well as one or more instance of a polybot worm from the Gaobot
Agobot family.

If you are her tech support and are computer savvy, you'll need to pay a
visit to her and clean up her computer. If you can't do this, then she
should call a professional to either come over or she should take the
computer to a local computer repair shop (not a BestBuy or CompUSa type
of store) for clean-up where they can set her up correctly.

Malke

 

[Stacie]

Oh really? Ok, thanks. We ran her Norton and it came up with no viruses.
Can a virus go undetected by Norton?

Thanks again.

 

[Ken Blake, MVP]

In

Hi to anyone that can assist me.

My grandmother just got a new PC and everything has been ok with it
so far. It is an HP and running XP Home. She is on dial-up. When
she goes to dial up and gets signed in...she gets the following error
message:

c:/windows/system32/sass.exe
Status Code 1073741819

Shutdown Initiated by
NT Authority/System

When that message pops up, her browser just shuts down and she cannot
get on-line.

Does this look somewhat familiar to anyone? Any suggestions or
advise would be greatly appreciated!!

She has the Sasser worm.

First go to Start | Run and type shutdown -a

That will stop it from shutting down.

Then read here:


http://vil.nai.com/vil/content/v_125007.htm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
http://www.microsoft.com/security/incident/sasser.asp

 

[Malke]

Oh really? Ok, thanks. We ran her Norton and it came up with no
viruses. Can a virus go undetected by Norton?

Thanks again.

Absolutely if she hasn't got a current version of Norton and/or hasn't
been updating her definitions. Perhaps it was a trial version that came
with the computer and she didn't renew the subscription.

Malke

 

[Stacie]

Thank you VERY much to both you and to Malke.

It makes sense then that she has the Sasser virus because she was running a
trial of Norton that must have expired.

I am going to try and repair this myself, but I am not very techy.
Fortunately for me, I am really good friends with the head of my IS
department at work. Maybe I should just be safe and take it to him.

Again, thank you very much for your detailed assistance!!!

Stacie

 

[Malke]

Thank you VERY much to both you and to Malke.

It makes sense then that she has the Sasser virus because she was
running a trial of Norton that must have expired.

I am going to try and repair this myself, but I am not very techy.
Fortunately for me, I am really good friends with the head of my IS
department at work. Maybe I should just be safe and take it to him.

Again, thank you very much for your detailed assistance!!!

Stacie

You're welcome, Stacie. You're a good granddaughter and yes, just take
it to your friend.

Cheers,

Malke

 

[Ken Blake, MVP]

In

Thank you VERY much to both you and to Malke.

You're welcome. Glad to help.

It makes sense then that she has the Sasser virus because she was
running a trial of Norton that must have expired.

I am going to try and repair this myself, but I am not very techy.
Fortunately for me, I am really good friends with the head of my IS
department at work. Maybe I should just be safe and take it to

him.


That's certainly a good idea. But look over his shoulder and
learn from him as he does it.