Re: Sasser worm and MS04-011

From: Andrew Mitchell (amitchell_at_removecasey.vic.gov.au)
Date: 05/03/04


Date: Sun, 02 May 2004 22:04:22 -0700


<anonymous@discussions.microsoft.com> said

> Well... I tried shutdown -a as a run command and got the
> error message that the file shutdown could not be found.
> I did a search for shutdown and found nothing. What am I
> doing wrong?
>

Are you sure you have the Sasser worm? As far as I know Sasser does not
shutdown your computer. This sounds more like blaster or one of its variants.

Exactly what does the message say when your PC is being restarted?

One thing you might try (but you will have to be fairly quick at doing this)
is to click Start, then Run then type 'services.msc' and click OK.
In the window that appears, find and double-click the Remote Procedure Call
(RPC) Service (*NOT* the RPC Locator).
In the properties for the service, select the 'Recovery' tab and change the
settings to read "Restart the service" for 1st, 2nd and subsequent failures.

Andy.



Relevant Pages

  • Re: rundll32.exe will not close on shutdown
    ... just started getting an error message ... > on shutdown or restart. ... I had that problem and it was a bridge linking into my rundll file. ...
    (microsoft.public.windowsxp.general)
  • Re: Windows XP - Shut Down Prob
    ... you're missing a shutdown error. ... you can disable the automatic restart. ... you may get a blue screen with an error message. ...
    (microsoft.public.windowsxp.basics)
  • Re: Application Error
    ... Did you follow my instructions and look for SW.exe or try the Task Manager ... And uninstalling it, I assume, will not solve the problem. ... What happens if you reboot, do nothing, and then shutdown? ... Your error message that you stated was 'sw: ...
    (microsoft.public.windowsxp.newusers)
  • Re: End Program - sw error
    ... in the End Program pop up window. ... This pop up occurs after I receive the DWWIN error message which states that "dwwin.exe dll failed to initialize error when shuting down". ... If ClearPageFileAtShutdown is set to 1, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Sasser Symtoms Without the Virus
    ... > The computer is exhibiting Sasser type symptoms: ... > pops up indicating a problem with the LSASS and later a shutdown is ... the LSASS error message pops up almost as soon as the ... I've tried renaming file ...
    (microsoft.public.windowsxp.general)