So I know the "culprit" is Isass.exe.  What then?  Can I delete it?         Ann Fennell

----- Original Message ----- 
From: Paul J. Traynor 
To: [log in to unmask] 
Sent: Sunday, August 22, 2004 6:55 AM
Subject: Re: [PCSOFT] Sasser Worm?


Hi,

I'll bet if you look under the hood so to speak by using something like
task manager or a third party utility for showing up processes running
you might just see something in that list called "lsass.exe" which might
point to the culprit.

Paul.


-----Original Message-----
From: PCSOFT - Personal Computer software discussion list
[mailto:[log in to unmask]] On Behalf Of Tom Mayer
Sent: 20 August 2004 17:06
To: [log in to unmask]
Subject: Re: [PCSOFT] Sasser Worm?


Here is some information that might help:

http://www.onlinepcfix.com/virushelp/sasser.htm

Tom Mayer



I have been trying to help a retired fellow with his computer woes.  His
machine runs fine until he logs onto his ISP, then it will shut down
within minutes.  The error message has to do with lsass.exe, and the
windows displayed conform exactly to those with a Sasser worm problem.
Yet, we can find no worm!  Symantec's tool to remove the worm finds none
existing.  A Norton's AV scan says his machine is clean.  None of
Microsoft's list of processes that are indicative of the worm are
running on his machine.

Any tips?  Could this be other than a Sasser Worm?

Thanks for any help.

Gordon

                         PCSOFT's List Owner's:
                      Bob Wright<[log in to unmask]>
                       Drew Dunn<[log in to unmask]>

      "Hold No Punches.." Rode brings you great shareware/freeware
        programs with his honest opinions in this weekly column.
                       http://freepctech.com/rode

                Curious about the people moderating your
                   messages? Visit our staff web site:
                    http://freepctech.com/staff.shtml