 |
 |
We are also seeing this, and the Symantec tool is not detecting on our PCs either. The error message we see says, in part, "LSASS.exe termintaed with code 128." Gene On 5/3/2004 11:09 AM, Cameron Ramo Williams wrote: > Hello fellow NAGers > > I was wondering if anyone here has found evidence of new Sasser worm > variants on campus PCs? We have a couple PCs that exhibit the random > reboots that make me suspect they have been infected with the Sasser > worm, > but the removal tools I downloaded from Symantec have been run > repeatedly on > these PCs in safe mode and have not found any evidence of Sasser. > According > to Symantec, the removal tools cover the initial Sasser worm and > variants B > and C. I just wondered if anyone else has found evidence of Sasser > but have > been unable to get a removal tool to detect it's presence? I surmise > it is > some new variant that the removal tool is not able to locate and remove. > Any others with this experience today? > > Thanks! > > Cameron Williams > --- > _______________________________________ > Cameron R. Williams > Information Technologist > Center for Global Change and Earth Observations > Michigan State University > 101 Manly Miles > East Lansing, MI 48825 > (517) 432-4675 > [log in to unmask] -- *Gene Willacker* Systems Analyst H&FS Systems Operations Group Michigan State University Food Stores Building East Lansing, MI 48824 /1-517-353-1691/