| View previous topic :: View next topic |
| Author |
Message |
northern21
Cadet
Joined: May 31, 2004
Posts: 7
Location: Canada
|
 Posted: Mon May 31, 2004 8:37 am Post subject: Possible Sasser infection (m) |
|
|
Yesturday while on my computer i got an error that says your system is shutting down. Please save all your work in process and log off........ from what i did with some searching it sounds to me like the sasser infection, however when i do online and norton virus scans it turns up nothing. i've downloaded 4 different sasser removal tools and not one has found sasser infection. I am using an up to date virus scanner (nortons) and nortons personal firewall / xp built in firewall. I have all the critical updates. What i don't understand is how i was infected and why nothing turns out when i use the removal or scans? I also have run Adaware/Spybot search & destroy etc.... finds nothing suspicous.
Some help would be appreciated.
thanks
Lisa |
|
| Back to top |
|
 |
Marianna
1st Responder
Premium Member
Joined: Nov 05, 2003
Posts: 1581
Location: Canada
|
| Posted: Mon May 31, 2004 1:09 pm Post subject: |
|
|
HI northern21
try an on-line scan:
http://housecall.antivirus.com/
http://www.pandasoftware.es/activescan/activescan-com.asp
http://www.ravantivirus.com/scan/
HTH
_________________
"The only source of knowledge is experience"
Albert Einstein (1879 - 1955) |
|
| Back to top |
|
|
northern21
Cadet
Joined: May 31, 2004
Posts: 7
Location: Canada
|
| Posted: Mon May 31, 2004 9:06 pm Post subject: thanks for replying |
|
|
I have tried all the following online scans and they all come back as no
viruses?
Any ideas? |
|
| Back to top |
|
|
Marianna
1st Responder
Premium Member
Joined: Nov 05, 2003
Posts: 1581
Location: Canada
|
| Posted: Mon May 31, 2004 9:49 pm Post subject: |
|
|
Hi northern21
Download and run HijackThis - get it here:
http://www.tomcoyote.org/hjt/
Unzip, double-click "HijackThis.exe" and Press "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Click: "Save Log" (generates: "hijackthis.log")
Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates: "startuplist.txt")
pls. unzip HijackThis in its OWN folder - like C:\Hijackthis - as it will make backups and you want them to be in the same folder.
HTH
_________________
"The only source of knowledge is experience"
Albert Einstein (1879 - 1955) |
|
| Back to top |
|
|
AdamR
Cadet
Joined: Jun 01, 2004
Posts: 3
Location: UK
|
| Posted: Tue Jun 01, 2004 5:23 am Post subject: |
|
|
I can back this up.
A few days ago, had the same problem, the "windows is shutting down" box. I still get it periodically, and fortunately I am mostly at the PC so I can do shutdown -a quickly.
I have 3 PC's, and they have all done it.
They are all up to date with windows update.
They are all running AVG, latest datafiles.
Internet connection is firewalled.
No AV products/removal tools detect it at all.
VERY frustrating, especially as I was never infected i nthe first place! |
|
| Back to top |
|
|
northern21
Cadet
Joined: May 31, 2004
Posts: 7
Location: Canada
|
| Posted: Tue Jun 01, 2004 11:37 am Post subject: Here is my hijack this log as requested |
|
|
Logfile of HijackThis v1.97.7
Scan saved at 11:36:41 AM, on 6/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Browser Hijack Blaster\bhblaster.exe
C:\Program Files\BHODemon\BHODemon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
F0 - system.ini: Shell=Explorer.exe C:\PROGRA~1\PARENT~1\ParentalFilter.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\PROGRA~1\PARENT~1\ParentalFilter.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - Startup: BHODemon.lnk = C:\Program Files\BHODemon\BHODemon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Browser Hijack Blaster (no splash) (2).lnk = C:\Program Files\Browser Hijack Blaster\bhblaster.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O15 - Trusted Zone: http://www.columbiahousecanada.com
O15 - Trusted Zone: www.greenfieldonline.com
O15 - Trusted Zone: http://www21.pogo.com
O15 - Trusted Zone: www.tsn.ca
O16 - DPF: Mah Jong Garden by pogo - http://mahjong2.pogo.com/applet-5.8.2.1...assets.cab
O16 - DPF: Pop Fu by pogo - http://popfu.pogo.com/applet-5.8.2.19/p...assets.cab
O16 - DPF: Squelchies by pogo - http://squelchies.pogo.com/applet-5.8.2...assets.cab
O16 - DPF: Tri-Peaks by pogo - http://peaks.pogo.com/applet-5.8.2.19/p...assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://whackdown.pogo.com/applet-5.8.2....assets.cab
O16 - DPF: World Class Solitaire by pogo - http://klondike.pogo.com/applet-5.8.2.1...assets.cab
O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar...vSniff.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004...scan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/contr...assCln.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/Shar.../cabsa.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70939174-F42F-4824-B16F-68576AC38D8C}: NameServer = 206.47.244.43 206.47.244.89 |
|
| Back to top |
|
|
Marianna
1st Responder
Premium Member
Joined: Nov 05, 2003
Posts: 1581
Location: Canada
|
| Posted: Tue Jun 01, 2004 11:48 am Post subject: |
|
|
HI northern21
Check the following item(s) in HIjackthis - close ALL windows\browsers except HIjackThis and click "Fix checked":
F0 - system.ini: Shell=Explorer.exe C:\PROGRA~1\PARENT~1\ParentalFilter.exe
.............
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Unless you have the Spybot S&D option ‘Lock homepage from changes’ active, or your system administrator put this into place, have HijackThis fix this.
...........
Reboot and pls. post a FRESH log. Also are youor problems gone after rebooting??
_________________
"The only source of knowledge is experience"
Albert Einstein (1879 - 1955) |
|
| Back to top |
|
|
northern21
Cadet
Joined: May 31, 2004
Posts: 7
Location: Canada
|
| Posted: Tue Jun 01, 2004 2:05 pm Post subject: As requested here is an updated log |
|
|
Logfile of HijackThis v1.97.7
Scan saved at 2:04:15 PM, on 6/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Browser Hijack Blaster\bhblaster.exe
C:\Program Files\BHODemon\BHODemon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Hijack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.ca/
F0 - system.ini: Shell=
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - Startup: BHODemon.lnk = C:\Program Files\BHODemon\BHODemon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Browser Hijack Blaster (no splash) (2).lnk = C:\Program Files\Browser Hijack Blaster\bhblaster.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O15 - Trusted Zone: http://www.columbiahousecanada.com
O15 - Trusted Zone: www.greenfieldonline.com
O15 - Trusted Zone: http://www21.pogo.com
O15 - Trusted Zone: www.tsn.ca
O16 - DPF: Mah Jong Garden by pogo - http://mahjong2.pogo.com/applet-5.8.2.1...assets.cab
O16 - DPF: Pop Fu by pogo - http://popfu.pogo.com/applet-5.8.2.19/p...assets.cab
O16 - DPF: Squelchies by pogo - http://squelchies.pogo.com/applet-5.8.2...assets.cab
O16 - DPF: Tri-Peaks by pogo - http://peaks.pogo.com/applet-5.8.2.19/p...assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://whackdown.pogo.com/applet-5.8.2....assets.cab
O16 - DPF: World Class Solitaire by pogo - http://klondike.pogo.com/applet-5.8.2.1...assets.cab
O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar...vSniff.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004...scan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/contr...assCln.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/Shar.../cabsa.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70939174-F42F-4824-B16F-68576AC38D8C}: NameServer = 206.47.244.43 206.47.244.89 |
|
| Back to top |
|
|
Soufside
Cadet
Joined: Jun 01, 2004
Posts: 5
Location: UK
|
| Posted: Tue Jun 01, 2004 2:17 pm Post subject: |
|
|
simply...
check out this link (microsoft)-
http://www.microsoft.com/security/incident/sasser.asp
or download this from microsoft -
http://www.microsoft.com/downloads/deta...laylang=en
both will patch the sasser worm |
|
| Back to top |
|
|
northern21
Cadet
Joined: May 31, 2004
Posts: 7
Location: Canada
|
| Posted: Tue Jun 01, 2004 2:46 pm Post subject: Thanks |
|
|
But i've already downloaded and installed the patches from microsoft- there are no critical downloads for me when i visit the microsoft website. I also did a scan from one of those links you gave me & and says that there is no sasser infection. However i got the error that comes with the sasser virus two days ago but there is no sasser infection on my computer as far as i can tell. Either its a new varient or some how it was particially allowed to come through my firewalls and then they stopped it.
That is why i have posted here to see if anyone had any suggestions as to why i received the sasser error (lsass.exe error) and not have an infection. |
|
| Back to top |
|
|
Marianna
1st Responder
Premium Member
Joined: Nov 05, 2003
Posts: 1581
Location: Canada
|
| Posted: Tue Jun 01, 2004 4:03 pm Post subject: |
|
|
northern21
are you still having problems after rebooting??
_________________
"The only source of knowledge is experience"
Albert Einstein (1879 - 1955) |
|
| Back to top |
|
|
AdamR
Cadet
Joined: Jun 01, 2004
Posts: 3
Location: UK
|
| Posted: Tue Jun 01, 2004 5:23 pm Post subject: |
|
|
Same for me. Already been to the MS links and they tell me I am not infected.
hjt didnt highlight anything obvious to me either.
rebooting does not solve the problem. |
|
| Back to top |
|
|
Marianna
1st Responder
Premium Member
Joined: Nov 05, 2003
Posts: 1581
Location: Canada
|
| Posted: Tue Jun 01, 2004 5:58 pm Post subject: |
|
|
Download Ad-aware from here: http://www.computercops.biz/downloads-file-292.html
Install by double-clicking on the downloaded file.
After installing but before running, update Ad-aware by using its Globe icon.
After updating, shutdown and restart Ad-aware.
Ad-aware is ready to scan and clean your system following these steps:
Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
"Unload recognized processes during scanning."
Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
"Let Windows remove files in use after reboot."
Press "Scan Now"
Check option "Use Custom scanning options"
Check option "Activate In-Depth Scan"
Press "Select drives\folders to scan"
Select the active partition which is usually C:
Press "Next" to let Ad-aware scan your drives...
If it finds "bad" files and registry keys, press "Next" again
Right-click in that pane and choose "select all"
Press "next"
When it asks to remove all checked items, Press "OK"
Close Ad-aware, reboot your system and go on to Step 2 below.
Spybot S&D
The download for Spybot S&D is available here: http://www.computercops.biz/downloads-file-108.html
Install by double-clicking on the downloaded file.
Run Spybot S&D from desktop icon or Start menu.
Press "Search for updates" button to get list of updates available.
Press "Download updates" button.
Close all IE windows and close & restart Spybot S&D.
Press "Check for problems" button.
Have SpyBot remove all it marks in red by pressing "Fix selected problems"
Close Spybot S&D, reboot your system .
Problems still there??
_________________
"The only source of knowledge is experience"
Albert Einstein (1879 - 1955) |
|
| Back to top |
|
|
AdamR
Cadet
Joined: Jun 01, 2004
Posts: 3
Location: UK
|
| Posted: Tue Jun 01, 2004 6:03 pm Post subject: |
|
|
yes, done all that  |
|
| Back to top |
|
|
northern21
Cadet
Joined: May 31, 2004
Posts: 7
Location: Canada
|
| Posted: Tue Jun 01, 2004 6:13 pm Post subject: |
|
|
Yes done all that, third time in 2 days and all comes up clean? = i want to remind you that i've only gotten that lsass.exe error once and that's it.
And nothing is picking up the virus and all programs like spy bot search and destroy / adaware / microsoft sasser virus checker - all come up clean. Is it safe to say that i am not infected? that some how it was allowed to come in but my firewall blocked it?
Rebooting after the one time error helped i guess because i haven't seen it again yet. |
|
| Back to top |
|
|
|
|
You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0.
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
