Print

---

Try using the stinger tool from McAfee, it cleans a
number of major viruses including sasser, but I'm not sure
how many variants.  Its worth a shot.  It may pick up
a different virus if it is not sasser.

On Mon, May 03, 2004 at 11:21:06AM -0400, Gene Willacker wrote:

  We are also seeing this, and the Symantec tool is not detecting on our PCs
  either. The error message we see says, in part, "LSASS.exe termintaed with code
  128."

  Gene

  On 5/3/2004 11:09 AM, Cameron Ramo Williams wrote:

      Hello fellow NAGers

      I was wondering if anyone here has found evidence of new Sasser worm
      variants on campus PCs? We have a couple PCs that exhibit the random
      reboots that make me suspect they have been infected with the Sasser worm,
      but the removal tools I downloaded from Symantec have been run repeatedly
      on
      these PCs in safe mode and have not found any evidence of Sasser.Â
      According
      to Symantec, the removal tools cover the initial Sasser worm and variants
      B
      and C. I just wondered if anyone else has found evidence of Sasser but
      have
      been unable to get a removal tool to detect it's presence? I surmise it is
      some new variant that the removal tool is not able to locate and remove.
      Any others with this experience today?

      Thanks!

      Cameron Williams
      ---
      _______________________________________
      Cameron R. Williams
      Information Technologist
      Center for Global Change and Earth Observations
      Michigan State University
      101 Manly Miles
      East Lansing, MI 48825
      (517) 432-4675
      [log in to unmask]


  --
  Gene Willacker
  Systems Analyst
  H&FS Systems Operations Group
  Michigan State University
  Food Stores Building
  East Lansing, MI 48824
  1-517-353-1691