sasser or new virus?

[Guest]

I'm working on an XP Home computer. I was getting the typical sasser error
(lsass) followed by the 60 second reboot box. I run CA Etrust 7.1 with the
newest signature and I ran a sasser removal tool. Both scans found nothing.
The problem stopped when I finally got all my MS patches installed. Why
didn't my scans detect Sasser? Was this some kind of Trojan or malware? I
intend to run a spyware scanner as soon as I get back to work but don't
expect to find anything since this is a new install of XP. Do you still have
to remove Sasser after installing the MS patches? I haven't found any
documentation on that question yet. Thanks in advance.

 

[Kelly]

Did you run the patch, Teresa?

W32.Sasser Removal Tool (Line 321) Right hand side)
http://www.kellys-korner-xp.com/xp_tweaks.htm

 

[The Prophecy]

I'm working on an XP Home computer. I was getting the typical sasser
error (lsass) followed by the 60 second reboot box. I run CA Etrust
7.1 with the newest signature and I ran a sasser removal tool. Both
scans found nothing. The problem stopped when I finally got all my MS
patches installed. Why didn't my scans detect Sasser? Was this some
kind of Trojan or malware? I intend to run a spyware scanner as soon
as I get back to work but don't expect to find anything since this is
a new install of XP. Do you still have to remove Sasser after
installing the MS patches? I haven't found any documentation on that
question yet. Thanks in advance.

There is a new Sasser variant spreading (W32.Sasser.G). You may have been
infected with it.

 

[NoNoBadDog!]

Teresa;

There are new variants of the Sasser worm introduced all the time. CA
Eztrust is not well known for staying up to date. The patch form Windows
update disabled the variant that you have, but your computer is still
infected with it. I would recommend dumping EZTrust and getting Norton
Antivirus. It is generall the first of all the popular AV programs to
release patches and updates as new variants of known worms.

Please follow Kelly's very good advice and run the removals tool.

Your AV protection is only as good as the last update it has had. Perhaps
you should search for a new AV program.

Bobby

 

[Nick Goetz]

Teresa;

There are new variants of the Sasser worm introduced all the
time. CA
Eztrust is not well known for staying up to date. The patch
form Windows update disabled the variant that you have, but your
computer is still infected with it. I would recommend dumping
EZTrust and getting Norton Antivirus. It is generall the first
of all the popular AV programs to release patches and updates as
new variants of known worms.

Please follow Kelly's very good advice and run the removals
tool.

Your AV protection is only as good as the last update it has
had. Perhaps you should search for a new AV program.

Bobby

If you check Symantec's web site, you'll see that a new
"Liveupdate"is normally released once a week.

If you follow any newsgroups you'll find that Norton Antivirus (as
do some others) have a number of problems, including some with XP
SP2.

Etrust (vet) has updates just about every day (excluding weekends).
It has a much smaller footprint than Norton, is "fast", uses little
resources (by comparison). I've been using it for years and
recommend it to customers.

Norton is as good as any of the top scanners but is a "pain" to fix
when it falls over (and it seems to fall over too often for my
taste), and can "bog" down a slow, older system. It does an
excellent job of detecting infections... but... so do a lot of
others.

Another good choice: PC Cillin - generally rated better than
Norton.

I'd stick with ETrust.

Nick Goetz

 

[Ed H]

I've been with CA E-Trust since the free InoculateIT days. I've never been
infected and have had viruses detected and removed that infected others, I
love it.

 

[NoNoBadDog!]

Ed;

I never said it wasn't a good program. It just does not update as often
as some other products do. The "G" version of the Sasser worm, which the
OP has, will not be detected by EZTRUST yet, as it is not in their
signature database. Norton will detect and clean it.

I merely suggested the OP install Norton to clean her system. It was not
meant as a slam of ENTRUST.