Parents!

[Guest]

My parents' PC has the Sasser worm on it. One of their friends (a computer "expert") renamed the LSASS.EXE file to LSASS.ORG in an attempt at ridding them of the worm. Now the PC won't even boot. (No surprise there.) Of course, Mom comes up for Mother's Day Brunch and brings the PC for ME to fix. Trouble is, even with a startup disk I can't get to the C drive to rename the file back to an exe. Now I'm at a loss how to get at the file. Any ideas?

 

[Bruce Chambers]

Greetings --

Simply boot from the WinXP installation CD and use the Recovery
Console.

Description of the Windows XP Recovery Console
http://support.microsoft.com/directory/article.asp?ID=kb;en-us;Q314058


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[roger]

Hi Mike,

My parents' PC has the Sasser worm on it. One of their friends (a computer "expert") renamed the LSASS.EXE file to LSASS.ORG in an attempt at ridding them of the worm. Now the PC won't even boot. (No surprise there.) Of course, Mom comes up for Mother's Day Brunch and brings the PC for ME to fix. Trouble is, even with a startup disk I can't get to the C drive to rename the file back to an exe. Now I'm at a loss how to get at the file. Any ideas?

You could rename the file booting with the XP CD and going to the
recovery console.
Description of the Windows XP Recovery Console
http://support.microsoft.com/directory/article.asp?ID=kb;en-us;Q314058

Another option if the file system is FAT32 would be booting from a
Windows 98 boot disk, going to Windows\System32 and renaming the file.

HTH

 

[Guest]

You guys are the best. I didn't even think of that
Sometimes it helps to have someone smack you in the chops with the obvious answer.

 

[roger]

You're welcome Mike
The most obvious answers are sometimes the most difficult ones.