Advice re: possible worm???
Wednesday, September 17, 2003 by goodmorphing | Discussion: WinCustomize Talk
Suddenly IE won't work at all. I have tried sys restore. Cannot access online virus scan. Norton not finding anything at all. I was thinking about re-installing from disc, but if it is a worm or virus it might wipe out the disc. What should I do?
word works, defrag works, sys restore works, netscape works, trillian works.
If this comes through underlined it is not intentional...
word works, defrag works, sys restore works, netscape works, trillian works.
If this comes through underlined it is not intentional...
 |
|
Page 4 of 10 | |
|
|---|
Xerraire
Reply #63 Wednesday, September 17, 2003 5:25 PM
Reply #63 Wednesday, September 17, 2003 5:25 PM
GM
that one item listed, Isass.exe
is usually a result of a virus
"Added as a result of the RATSU.B VIRUS! Note! - the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
that one item listed, Isass.exe
is usually a result of a virus
"Added as a result of the RATSU.B VIRUS! Note! - the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
goodmorphing
Reply #64 Wednesday, September 17, 2003 5:27 PM
Reply #64 Wednesday, September 17, 2003 5:27 PM
GWMDMMSG and SK991ODM ?
by Scribe Fuzzy Logic - 9/17/2003 5:06:56 PM
The first is a Gateway modem and the second is a Gateway keyboard proggie.
I should kill which one?
by Scribe Fuzzy Logic - 9/17/2003 5:06:56 PM
The first is a Gateway modem and the second is a Gateway keyboard proggie.
I should kill which one?
goodmorphing
Reply #65 Wednesday, September 17, 2003 5:30 PM
Reply #65 Wednesday, September 17, 2003 5:30 PM
not yet kona, will get it now.
Xerraire - 9/17/2003 5:25:57 PM
GM
that one item listed, Isass.exe
is usually a result of a virus
... what should I do with it?
Xerraire - 9/17/2003 5:25:57 PM
GM
that one item listed, Isass.exe
is usually a result of a virus
... what should I do with it?
kona0197
Reply #66 Wednesday, September 17, 2003 5:31 PM
Reply #66 Wednesday, September 17, 2003 5:31 PM
Just a side note:
when I use XP on a system i usually go into msconfig and turn off everthing but essential services. So when it is all said and done, 10 or less things actually run when I start up the PC.
anyways...
when I use XP on a system i usually go into msconfig and turn off everthing but essential services. So when it is all said and done, 10 or less things actually run when I start up the PC.
anyways...
Xerraire
Reply #67 Wednesday, September 17, 2003 5:31 PM
Reply #67 Wednesday, September 17, 2003 5:31 PM
Its a result of a trojan
Here is a page of what to do
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.b.html
Here is a page of what to do
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.b.html
yrag
Reply #68 Wednesday, September 17, 2003 5:32 PM
Reply #68 Wednesday, September 17, 2003 5:32 PM
lsass.exe is a MS system file....you'll have to guess which process to kill.....feel lucky???
kona0197
Reply #69 Wednesday, September 17, 2003 5:34 PM
Reply #69 Wednesday, September 17, 2003 5:34 PM
goodmorphing:
this will kill ANY and ALL viruses and find them of course:
http://housecall.trendmicro.com/
this will kill ANY and ALL viruses and find them of course:
http://housecall.trendmicro.com/
goodmorphing
Reply #70 Wednesday, September 17, 2003 5:35 PM
Reply #70 Wednesday, September 17, 2003 5:35 PM
wow... its going to take me a long time to understand all of that.
kona0197
Reply #71 Wednesday, September 17, 2003 5:37 PM
Reply #71 Wednesday, September 17, 2003 5:37 PM
try my link. click on scan now...it will find and kill any virus!
goodmorphing
Reply #72 Wednesday, September 17, 2003 5:38 PM
Reply #72 Wednesday, September 17, 2003 5:38 PM
kona i tried that first thing, netscape has a problem downloading the needed components.
... let me see, does this feel like a lucky day....
heh
... let me see, does this feel like a lucky day....
heh
goodmorphing
Reply #73 Wednesday, September 17, 2003 5:39 PM
Reply #73 Wednesday, September 17, 2003 5:39 PM
well... if you don't hear from me for awhile, i killed the wrong one.
Fuzzy Logic
Reply #74 Wednesday, September 17, 2003 5:40 PM
Reply #74 Wednesday, September 17, 2003 5:40 PM
GWMDMMSG is the modem. The pc will run fine without it. Lsass is the Local Security Authority Service and is normally running.
To check for Ratsou open regedit and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run to see if HID.exe is there. If not it's not Ratsou.
[Message Edited]
To check for Ratsou open regedit and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run to see if HID.exe is there. If not it's not Ratsou.
[Message Edited]
goodmorphing
Reply #75 Wednesday, September 17, 2003 5:41 PM
Reply #75 Wednesday, September 17, 2003 5:41 PM
ODM is killed, and keyboard still works
goodmorphing
Reply #76 Wednesday, September 17, 2003 5:47 PM
Reply #76 Wednesday, September 17, 2003 5:47 PM
OOPS, I killed the wrong one then. 
might as well get the other one to, right?
regedit here i come
might as well get the other one to, right?
regedit here i come
goodmorphing
Reply #77 Wednesday, September 17, 2003 5:53 PM
Reply #77 Wednesday, September 17, 2003 5:53 PM
regedit, then find --- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and it said it finished searching
but it didn't say if it found anything or not ... i'm taking that to be negative
and it said it finished searching
but it didn't say if it found anything or not ... i'm taking that to be negative
goodmorphing
Reply #78 Wednesday, September 17, 2003 5:56 PM
Reply #78 Wednesday, September 17, 2003 5:56 PM
Both registry values have been killed and I am still here, I think. Blaster worm search still running.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 4 of 10 | |
|
|---|
Reply #61 Wednesday, September 17, 2003 5:24 PM