Re: Sasser Symtoms Without the Virus

From: Shenan Stanley (news_helper_at_hushmail.com)
Date: 06/02/04 

Date: Wed, 2 Jun 2004 16:30:09 -0500

Major Malfunction wrote:
> I'm working on a computer and I've got a real interesting problem:
>
> The computer is exhibiting Sasser type symptoms: an error message
> pops up indicating a problem with the LSASS and later a shutdown is
> initiated. While working the Safe Mode, the system was scanned for
> presence of Sasser and none was found. A manual check of the Registry
> and the usual infection location in the Windows directory shows no
> sign of infection either.
>
> In normal mode, the LSASS error message pops up almost as soon as the
> desktop is stable, but any shutdown is delayed until after a
> connection to the Internet is made. I've tried renaming file
> SHUTDOWN.EXE, but shutdown still occurs and the SHUTDOWN.EXE file
> reappears.
>
> I did remove *many* parasite programs, but the system is now clean,
> according to both SpyBot and X-Cleaner. Norton antivirus, with defs
> from 6/1/2004, shows the system clean of any known virus.
>
> Any clues what's happening here?

Reinstall SP1. 

-- 
<- Shenan ->
-- 
The information is provided "as is", with no guarantees of
completeness, accuracy or timeliness, and without warranties of any
kind, express or implied.  In other words, read up before you take any
advice - you are the one ultimately responsible for your actions.

Relevant Pages

  • Re: Application Error
    ... Did you follow my instructions and look for SW.exe or try the Task Manager ... And uninstalling it, I assume, will not solve the problem. ... What happens if you reboot, do nothing, and then shutdown? ... Your error message that you stated was 'sw: ...
    (microsoft.public.windowsxp.newusers)
  • Re: End Program - sw error
    ... in the End Program pop up window. ... This pop up occurs after I receive the DWWIN error message which states that "dwwin.exe dll failed to initialize error when shuting down". ... If ClearPageFileAtShutdown is set to 1, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Which svchost.exe (shutdown)
    ... it did not stop the shutdown error message at all. ... Please confirm if shutting off automatic updates worked on your computer? ... or you can simply end all svchost processes. ...
    (microsoft.public.windowsxp.help_and_support)
  • Sasser Symtoms Without the Virus
    ... The computer is exhibiting Sasser type symptoms: an error message pops up ... indicating a problem with the LSASS and later a shutdown is initiated. ... shows the system clean of any known virus. ...
    (microsoft.public.windowsxp.general)
  • Re: Not a problem, Dell shuts down faster using the POWER OFF button
    ... not a shutdown, per se, and can NOT be used when you are asked to reboot ... > I've always used the power button, of course I first went to Control Panel ... Don't you get tired of seeing the "Windows was not shut down ... >> properly" error message on start up? ...
    (microsoft.public.windowsxp.general)