RE: Sasser question

From: Sadie (anonymous_at_discussions.microsoft.com)
Date: 05/16/04 

Date: Sun, 16 May 2004 14:31:41 -0700

Oh!At last!

Thanks,Cecil!I'll copy and paste that,if I may.There's
another lady experiencing the same issue.

Sadie
>-----Original Message-----
>try using the shutdown -a command "abort current system
shutdown"
>
>try the "create read-only dcpromo.log file" trick which
will stop sasser - tip on Microsoft website
www.microsoft.com/sasser.
>
>The following is taken from the "for Windows Xp"
instructions at the Microsoft sasser website :-
>Step 2: Stop the Shutdown Cycle
>This worm may cause LSASS.EXE to stop responding, which
forces the operating system to shut down after 60
seconds. If your computer starts to shut down, follow
these steps to abort any system shutdown that may be in
progress.
>
>On the taskbar at the bottom of your screen, click
Start, and then click Run.
>Type: cmd and then click OK.
>At the command prompt, type: shutdown.exe -a and then
press ENTER.
>Step 3: Mitigate the Vulnerability
>You can temporarily remove the vulnerability that allows
the worm to infect your computer by creating a log file.
>
>Create the log file
>
>On the taskbar at the bottom of your screen, click
Start, and then click Run.
>Type: cmd and then click OK.
>At the command prompt, type: echo dcpromo >%systemroot%
\debug\dcpromo.log and then press ENTER.
>Make the log file read-only
>
>At the command prompt, type: attrib +R %systemroot%
\debug\dcpromo.log and then press ENTER.
>
>--
>Make sure you turn your firewall on and keep it on (if
you are running WinXp or later), or buy a firewall if you
are using Win200.
>
>Then make sure you immediately run the Microsoft sasser
cleaner tool (see website), then update the system using
Windows Update.
>
>Set the system to install "Critical Updates"
_automatically_ through Windows Update too to prevent
this happening again.
>
>Regards,
>
>Cecil Ward.
>.
>

Relevant Pages

  • Re: User cannot shutdown from start menu?
    ... If they logoff first though, ... > shutdown from the ctrl+alt+del screen. ... If this post is viewed at a non-Microsoft community website, ... please direct all replies ONLY to the Microsoft public newsgroup ...
    (microsoft.public.win2000.active_directory)
  • Re: User cannot shutdown from start menu?
    ... shutdown on the start menu, but when the shut down windows dialouge box ... > If this post is viewed at a non-Microsoft community website, ... > unless that website posts replies back to the original Microsoft forum. ... > Microsoft Windows MVP - Windows Server - Directory Services ...
    (microsoft.public.win2000.active_directory)
  • Re: NT Authority..
    ... You could have Blaster or you could have Sasser. ... the Microsoft provided information on the matter can be ... The patch that would have prevented this whole fiasco for you: ... After enabling the Internet Connection Firewall or creating the read-only ...
    (microsoft.public.windowsxp.help_and_support)
  • RE: add a new website to share point problem
    ... prefix (http in the example) indicates its protocol. ... Microsoft is providing this information as a convenience to you. ... Microsoft CSS Online Newsgroup Support ... add a new website to share point problem ...
    (microsoft.public.windows.server.sbs)
  • Re: Messenger shuts down system
    ... You may have Sasser.. ... the Microsoft provided information on the matter can be ... The Symantec Repair utility and manual removal instructions can be found ... After enabling the Internet Connection Firewall or creating the read-only ...
    (microsoft.public.windowsxp.newusers)