Name that Virus

VeNT · 14 Nov 2006 at 20:57

you know the one, where when you login you get that NT authority thingy and then your PC shuts down

come on guys, its been bugging me all day, what was it called?

killer_uk · 14 Nov 2006 at 20:59

Blaster?

Poolybit · 14 Nov 2006 at 20:59

msblaster?

\Edit BEATEN

\Editx2 Could also be sasser...did similar things.

VeNT · 14 Nov 2006 at 21:21

blaster that's the one!

VeNT · 15 Nov 2006 at 00:14

ok, it wasn't blaster (or atleast norton didn't pick it up!)
other ideas?

JonnyT · 15 Nov 2006 at 00:22

Sasser? (lsass.exe)

VeNT · 15 Nov 2006 at 00:44

any others?
Blaster
Sasser

beagle? Welcher?

Efour · 15 Nov 2006 at 05:47

i had one of these back in the day, nasty buggers

celliott · 15 Nov 2006 at 08:11

JonnyT said:
Sasser? (lsass.exe)

Er are you sure lsass.exe is the virus? All my pc's seem to have this process with NOD32 installed.

Smit · 15 Nov 2006 at 08:31

celliott said:
Er are you sure lsass.exe is the virus? All my pc's seem to have this process with NOD32 installed.

It's on systems without NOD32 installed also I believe... My works PC has this process running and it doesn't have NOD32 on it.

masterk · 15 Nov 2006 at 08:39

lsass.exe is a normal system process, the virus one is something like Lsass or something silly like that.

VeNT · 15 Nov 2006 at 09:51

od, I've taken the drive out of that infected pc, put it in a caddy and been checking it with those symantec progs to clear those viruses, all have come up clear

Raumarik · 15 Nov 2006 at 10:02

Did you run the Mcafee stinger on it? gets rid of most of the worse viruses:

http://vil.nai.com/vil/stinger/

ruffneck · 15 Nov 2006 at 10:39

sasser was lsasss.exe the extra s

lsass.exe is Local Security Authority Subsystem Service

The_KiD · 15 Nov 2006 at 11:26

It is blaster and stinger will remove it, but you need to get the updates from MS to stop it re-infecting.

Lsass.exe as stated is a normal process for the security service in windows.

Blaster would show as Isass.exe (capital i instead of lowercase L ).

VeNT · 15 Nov 2006 at 15:04

this is so odd, as the system was all up to date with windows update (last update was 4 days before infection.) I don't get how it was infected. is there any other possability?

ok scratch that, its not showing ANY infection, just the symptoms, theres no blaster or sasser or anything else I know of on here!

VeNT · 15 Nov 2006 at 18:05

ok, so its doing it when its not connected to the internet, when its been scanned for viruses and worms by nod, symantec, McAffy and AVG etc but still nothing showing up
yet every time it boots I get the NT Authority Shutdown message and the damn thing reboots, I ran shutdown -a and that just crashed the damn thing.