Sasser & WIN XP

[pennydog]

I have just installed win xp on my IBM Thinkpad 600E. I was in the process of installing my setup for the DSL. I got halfway with
the set up and I get the message: Your system will shut down in 60 seconds due to system 32/lsass.exe. 1073741819. I got the dsl connection to work and get online, however, the laptop will not stay logged on long enough for me to install the required update/patch. Nor will it stay up long enough for me to install my firewall or AV. It will shutdown after about 2 minutes of being online. I just went in and disabled the restore thing, but I cannot find where to turn on the XP firewall.

How can I install the required updates if it will not stay booted up long enough for me to get them downloaded? It gets to 50% and then does the shutdown thing due to sasser. I cannot not even register my copy of XP because it will not stay up long enough. What can I do? I cannot get anything done in the 2 minutes before it shuts down. Any suggestions are appreciated. Thanks. I can work in safe mode as long as I am not online. It does the same shut down thing even in safemode.

[DuaneB]

To stop your machine from shutting down when the message is displayed, simply go to the start menu and select run. Then type shutdown -a in the text box and click the OK button. This will stop the machine from shutting down.

Avert Stinger should get rid of Sasser.
http://vil.nai.com/vil/stinger/


Here's the removal tool from Symantec.
http://securityresponse.symantec.com...oval.tool.html

[pennydog]

Well ok, thanks for the tip. However, I went to run, typed shutdown -a and clicked ok. I tried to get the updates once more and within 2 minutes it shut down again. So that did not work. Anything else I can do?

[DuaneB]

Did you enable your firewall?

1. In Control Panel, double–click Networking and Internet Connections, and then click Network Connections.
2. Right–click the connection on which you would like to enable ICF, and then click Properties.
3. On the Advanced tab, check the option to Protect my computer and network....


Enable your firewall and install your AV program before you connect to the internet.

[pennydog]

In the control panel I have an icon that says network connections, it is diabled because the connection is not available. I have an internet options icon, but nowhere do I see to enable the firewall. I looked under all tabs and nothing says network or enable the firewall.

[DuaneB]

Your Network Connections should not be disabled even if you're not on the internet.

Try this: (right-click) Start > Properties > (tab) Start Menu > (button) Customize > (tab) Advanced > scroll down to Network Connections and mark the circle that says Display as Connect to menu > OK > Apply > OK.

Then go to: Start > Connect To > Show All Connections > (right-click) the connection on which you would like to enable the firewall > Properties > (tab) Advanced > "Protect My Computer ....." > OK

[DuaneB]

Since you apparently have access to another computer try downloading Stinger (see link above) to a floppy and run it on the infected computer from the floppy.

[pennydog]

Thanks DuaneB for the easy to follow instructions. I got there very easy that time. After I told it to protect and clicked ok. I got this message: an error occurred while internet connection sharing was being enabled. The dependency service or group failed to start.

I am using my home computer while trying to get my laptop running. I will download the removal program to a disk. Thanks.

[DuaneB]

Apparantly you have the service (or a dependency) disabled. See here:

http://www.smartcomputing.com/techsu...&ErrorID=21695

[pennydog]

Thanks so much D!!! I got that all repaired and firewall is up and running. I am scanning now with stinger and so far it has found 3 different viruses and worms. I don't understand how that can be since I just re-formatted the hard drive and installed a clean WIN XP. I was online about 2 minutes when I got the error message and it started shutting down.

After I am done with the stinger, I will install the AV and then I will try again to get online and register my XP program and get the updates. Thanks so much for the help. I will post back if I cannot get it to stay online after all this is done.

[DuaneB]

2 minutes is plenty of time to get nailed. Good luck.

[pennydog]

I should say it is!! Stinger found 5 different worms and the AV found another. All that in 2 minutes!! Is the XP firewall good enough or do I need to install a different one?

[DuaneB]

XP's firewall is considered weak and most people use a 3rd party firewall instead. I use Norton Internet Security (which includes a firewall). Here are some others that people have been using and liking (mostly it's a matter of preference - they're all good).


Firewalls

- ZoneAlarm (http://www.zonelabs.com):
Has both a free limited functionality version and a full featured version for purchase

- Kerio Personal Firewall (http://www.kerio.com):
Free for home/personal use; otherwise $39 for a single user license

- Outpost Personal Firewall (http://www.agnitum.com):
Open Architecture firewall for Windows; both free and "pro" versions available

- Sygate Personal Firewall (http://www.sygate.com)

- Norton Personal Firewall (http://www.symantec.com)

- Black Ice Defender (http://www.networkice.com)

[pennydog]

Thanks DuaneB for all of your help in getting our laptop cleaned up and running. I will install Kerio because I had saved it to a cd last night to use, but have not loaded it in yet. I am having trouble getting my internet service to install all the way. It says a problem with the hardware, but we have checked and it all seems to be updated and working ok. That is really no big deal as we can get the email thru the pop3.

I had no idea a system could be compromised so fast, but it sure made a believer out of me!! Again, thank you.