Shutdown...still!

[mambonuts]

I am running XP and have been setting myself up for protection after my previous woes...

I have a virus program, firewall, ad aware...etc, etc...

I had a virus problem a few months ago, and still have one tid-bit left to get rid of...

I would like to know how to get rid of the "Isass.exe" shutdown window that appears when I'm online...

Don't give me any links for removal tools from Norton etc, because I have tried them all, and still have the shutdown window...

Someone mentioned about changing or deleting some files from the registry to rid my computer of the "Isass.exe" shutdown window...

If anyone has a simple walkthrough on how to do this, I would greatly appreciate it...

Thanks in advance...

 

[bcastner]

I"sass.exe is bad
"L"sass.exe is good

I suspect you have the bad one.

http://www.pestpatrol.com/pestinfo/b/backdoor_optix_pro_132.asp

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_OPTIX.G&VSect=Sn

There are some variants for which there are not as of this date (1-22-2005) removal methods yet. Expect something soon.

For early January, 2005 variants, it is possible Trend Micro online scan can deal with this.

http://www.mvps.org/sramesh2k/Scanners.htm

 

[linney]

Shutdown -a from Start Run will stop any Shutdown.

The latest round of Microsoft Security patches included removal tools for various malicious infections.

The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000

http://support.microsoft.com/?kbid=890830

Lsass.exe should not need access to the Internet on a StandAlone machine.

http://www.pcplus.co.uk/tutorials/d...eid=11202&subsectionid=376&subsubsectionid=73

 

[tchatzi]

Run the patches for 'sasser' and 'blaster' (although blaster hits RPC) dont use the 'fix sasser', download and run the patch from here.

http://www.microsoft.com/downloads/...9e-da3f-43b9-a4f1-af243b6168f3&displaylang=en

and i wonder if you do have a firewall if you know how to set it up.

You know firewalls dont think much, you have to tell them what you want themto do.
So you can block the ports you dont use

If you dont know anything about ports take a look at this

http://www.iss.net/security_center/advice/Exploits/Ports/default.htm

Read somethiing about firewalls and tcp/ip security

http://netsecurity.about.com/od/hackertools/a/aa072004.htm

http://www.pcmech.com/show/network/356/

http://www.private.org.il/tcpip_rl.html

Good luck