Question Regarding Sasser

[Jerry]

Hi,

Like many of the other posts I've read - I'm trying to help my sister-in-law
over the phone with a virus problem. Seems it doesn't matter how well my
computers are protected (firewalls, Virus detections, up-to-date patching) I
always end up messing with somebody elses problems.

Anyway, the symptom was clearly Sasser:
a.. Your computer performance is degraded or your network connection is
slow.
a.. You may see a dialog box with text that refers to LSASS.exe.
a.. Your computer may reboot every few minutes without user input.

So after googling it I found lots and lots of help - as expected - computer
people are the best. Thank God we don't use lawyers to fix computers!

Anyway - I walked her through downloading Stinger from McAffee - restared
computer and ran the full scan. This scan found:
W32/Nachi.worm.b virus and eliminated it.

Ran it again - and no viruses - It never said anything about Sasser.

The symptoms continued so I had her download the latest quick fix form
Symantec - It never saw sasser either yet she continues to have the problem.

My question, if Sasser is on a PC will these program Always find it? If
so - what the heck is causeing this problem (sure looks like Sasser symptoms
to me and it started a couple days ago - not a likely coincidence)

I will have her PC this weekend and I'm sure once I've caught up with all
the patches it will be alright. I just wanted these magic bullets from
Symantec and McAffee to bail me out. Over 3 hours on the phone so far!!!


Thanks

 

[Clay]

Hi,

Like many of the other posts I've read - I'm trying to help my sister-in-law
over the phone with a virus problem. Seems it doesn't matter how well my
computers are protected (firewalls, Virus detections, up-to-date patching) I
always end up messing with somebody elses problems.

Anyway, the symptom was clearly Sasser:
a.. Your computer performance is degraded or your network connection is
slow.
a.. You may see a dialog box with text that refers to LSASS.exe.
a.. Your computer may reboot every few minutes without user input.

So after googling it I found lots and lots of help - as expected - computer
people are the best. Thank God we don't use lawyers to fix computers!

Anyway - I walked her through downloading Stinger from McAffee - restared
computer and ran the full scan. This scan found:
W32/Nachi.worm.b virus and eliminated it.

Ran it again - and no viruses - It never said anything about Sasser.

The symptoms continued so I had her download the latest quick fix form
Symantec - It never saw sasser either yet she continues to have the problem.

My question, if Sasser is on a PC will these program Always find it? If
so - what the heck is causeing this problem (sure looks like Sasser symptoms
to me and it started a couple days ago - not a likely coincidence)

I will have her PC this weekend and I'm sure once I've caught up with all
the patches it will be alright. I just wanted these magic bullets from
Symantec and McAffee to bail me out. Over 3 hours on the phone so far!!!

It's possible you may have a variant of Sasser that is not getting
detected by the programs you've tried.

Maybe have a look at: http://www.f-secure.com/v-descs/sasser_d.shtml
and try their removal tool *after* fully reading disinfection
instructions from 'f-sasser.txt'.

 

[Joe G]

Microsoft has a web page dealing with this worm, they even have a test to
see if you have it...
http://www.microsoft.com/security/incident/sasser.asp

the test is quite simple and painless. I received the link from my ISP,
they want everyone to check and see if they are infected. Anyway, glad to
share.

Joe