sfjacobs
asked on
NT Authority/WINNT/SYSTEM32/|sass.exe Shutdown
My Windows 2000 Server SP 4 keeps rebooting. Before it reboots, it displays the message
NT Authority
WINNY/SYSTEM32/|sass.exe termianted unexpectedly.
Please note that I think the first character in the file |sass.exe is the | character. It could be the i or the l (el, L) character, but it's hard to tell.
How can I fix this problem?
Seth
NT Authority
WINNY/SYSTEM32/|sass.exe termianted unexpectedly.
Please note that I think the first character in the file |sass.exe is the | character. It could be the i or the l (el, L) character, but it's hard to tell.
How can I fix this problem?
Seth
I assume it's LSASS.EXE. This might be a symptom of the W32/Sasser.worm that spreads by exploiting the MS04-011 vulnerability:
http://vil.nai.com/vil/content/v_125007.htm
http://vil.nai.com/vil/content/v_125007.htm
It is w32.sasser.b.worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
W32.Sasser.B.Worm differs from W32.Sasser.Worm as follows:
Uses a different mutex: Jobaka3.
Uses a different file name: avserve2.exe.
Has a different MD5.
Creates a different value in the registry: "avserve2.exe."
How to clean your machine ?
1.Download the patch from http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
2.Download Reomval Tool from here http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html
3.disconnect from network
4.install the patch (if it prevent you by rebooting the machine ! end the process called avserve2.exe ,any process with a name consisting of four or five digits, followed by _up.exe (for example, 74354_up.exe).
5.logon with SAFE MODE
6.scan your machine with FxSasser.exe (You must have Administrator rights)
7.end
Uses a different mutex: Jobaka3.
Uses a different file name: avserve2.exe.
Has a different MD5.
Creates a different value in the registry: "avserve2.exe."
How to clean your machine ?
1.Download the patch from http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
2.Download Reomval Tool from here http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html
3.disconnect from network
4.install the patch (if it prevent you by rebooting the machine ! end the process called avserve2.exe ,any process with a name consisting of four or five digits, followed by _up.exe (for example, 74354_up.exe).
5.logon with SAFE MODE
6.scan your machine with FxSasser.exe (You must have Administrator rights)
7.end
Glad I could help you. Thanks for the points!
my pc will only open then said to install\system32\ntoskrnl. exe i am a beginer, so all this is greek, i am on my sons pc to get help.
I have the same problem but just if I conect by dial Up, if I use the DSL/Cable its working fine.
What is matter.
Thanks
Darli
What is matter.
Thanks
Darli
I would recommend to open your own thread for this question.
All of the above is fine, but what if you can not get the PC to boot to DOS or CD drive? All I want to do is a format with the restore disk to clean out everyhing? I have been on line with HP support and Microsoft and no one can assist me?
lsass.exe error just want to start clean with the recover cd, but no matter what I do it will not start it from DOS or the cd drive
even hp's support group could not help i tried everything they told me to do.
Virus Checking
If you cant get the PC to boot you will need to scan from Dos
http://www.europe.f-secure.com/download-purchase/tools.shtml
Online (Free) Virus Checking can be done at
SYMANTEC (You must have ActiveX enabled on your browser for it to work!)
http://security.symantec.com/ssc/vc_scan.asp?j=1&langid=ie&venid=sym&plfid=23&pkj=ROSUPWFYJOKMFIDPMSV
Trend Micro (Housecall)
http://housecall.trendmicro.com/
But You really Need some good quality Anti Virus Installed!
FreeWare
AntiDote Lite http://www.vintage-solutions.com/English/Antivirus/Super/index.html
Avast http://www.avast.com/
F-Prot http://www.f-prot.com/products/
V-Catch http://www.vcatch.com/download.html
The BIG Boys in AV
McAfee
http://www.mcafee.com/default.asp
Symantec (or the firm formally known as Norton)
http://www.symantec.com
Sophos (This Protects My Corporate Network)
http://www.sophos.com/
Command
http://www.commandsoftware.com/