Help! Virus on laptop? Cannot login. Sasser?

notanothergreyhair

Hi,

I have tried to boot up my laptop this afternoon (it was fine this morning) and have encountered a problem. When the user password screen comes up, I receive a message telling me that the system has to shut down and has been initiated by \

It says: c:\windows\system32\lsass.exe with error code 1073741819

I have looked on the net for solutions (am on my dad's pc atm) but they all seem to require having access to the normal desktop screen - I cannot get that far.

All help will be very much appreciated.

NAGH

albertross_2

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050114-1706-99


is this a patched sp2'd firewalled xp pc? if so. it may not be sasser related. Can you get into safe mode (F8 at boot)?

start, run, shutdown -a should stop it shutting down, if you can get past the login screen

notanothergreyhair

albertross wrote: »

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050114-1706-99


is this a patched sp2'd firewalled xp pc? if so. it may not be sasser related. Can you get into safe mode (F8 at boot)?

start, run, shutdown -a should stop it shutting down, if you can get past the login screen

It hadn't been letting me in safe mode, but I think it might just have changed its mind...

It is SP2 XP with firewall, not sure quite what you mean exactly by 'patched' (apologies).

albertross_2

Patched means upto date with microsoft fixes, if you have sp2 installed, then in control panel, security center, there should be a firewall and automatic windows updates, which should both be switched on, and would protect you against sasser and other worms.

notanothergreyhair

I definitely receive automatic updates (sometimes causing that annoying navcncl thing) and firewall is on.

I can get into safe mode, but then I only have about 40 seconds before it decides to reboot. When that error code appears there is a 60 second countdown timer started.

albertross_2

do start, run

shutdown -a

to stop the reboot

then run a virus scan to make sure you are clean, if you are patched as you say, then you shouldn't have sasser, unless there is a new variant out there.

notanothergreyhair

I am going to try it, as soon as I can see th 'run' button

It won't let me in under my user, but will as an administrator. Trouble is, the display is in a ridiculous resolution and I cannot see the run button on the start menu. Grr

espresso

Try the windows flag key + r

notanothergreyhair

phew...I stopped it shutting down. Thank you both.

I will virus scan right now and see what happens.

Tha_Business

Updates...........

notanothergreyhair

Hi,

My virus scan lasted just over 2 hours. It found one trojan and deleted it.

I cannot access the internet on it in safe mode, in order to check out the symantec link above. It won't allow me to login as administrator in 'safe mode with networking' either.