C:\WINDOWS\Sytem32\lsass.exe and LSA Shell (Export Ver.)Follow

WTF is this? I think there is some kind of virus or program on my server (Quetzalcoatl) which is causing computers to restart during FF XI. My roomate has NEVER downloaded a program asides from the FF XI patches and has experienced this as well. This is a serious problem, which is spreading, but I am uncertain of how many people are dealing with this. Somehow, it's downloaded onto your computer when you log onto FF XI. I know someone else on my server who mentioned it. I dont know much about viruses, but I never would have imagined that we could get one on the PlayOnline server. This is no hoax, slowly, you will notice more and more people talking about this. I am currenlt awaiting a response to a GM call... anyone else having trouble with this virus / bug?

Lovewind
Quetzalcoatl

P.S. - I read the prior post about someone else having restarting issues, I am not sure if this is the same problem. I have attempted to uncheck the automatic restart, but this seems like a temporary solution.

http://ffxi.allakhazam.com/forum.html?forum=28&mid=108346771867782838&num=0


I dont know why this guy's post is in off topics, but check it out.

Sasser is a rather nasty Blaster varient.

If you can still get online on the infected computer:
[li] Press Start
[li] Go to Run
[li] Type in services.msc
[li] On the Local Services list, double-click on Internet Connection Firewall ICF
[li] Set the Startup Type to Automatic
[li] In the Service Status area, press Start to enable your Windows XP firewall. (It's better than nothing when it comes to keeping worms out)

If you can't get this to work, try booting to Safe Mode and enabling it there.

Now go online to http://securityresponse.symantec.com/avcenter/FxSasser.exe and download and run the removal tool. Follow the instructions carefully.
There are currently 3 known variations of the Sasser worm, (according to Norton).

Make sure to go online to http://v4.windowsupdate.microsoft.com/en/default.asp when the removal is complete, so that you can download the most current Critical Updates.


If the 60 second timer turns on at any point:
[li] Press Start
[li] Go to Run
[li] Type in shutdown -a

This will turn off the timer, and allow you to continue with the removal process.

Resetting or disabling the RPC timer in Safe Mode only gets results in a few cases with this version of Blaster.
It's better just to do the Shutdown -a.

Edited, Mon May 3 03:46:53 2004 by LadyOfHolyDarkness

Edited, Mon May 3 20:25:03 2004 by LadyOfHolyDarkness