Re: Possible New Sasser Variant

Syklops wrote:

> I work in Technical support for BT Yahoo Broadband and had a call from a =
> guy who appeared to have the sasser, the system was shutting down when =
> trying to access websites, and I attempted to fix the problem using =
> CTRL+ALT+DEL and kill the lsasss process, however, when I do that, Task =
> Manager does not appear. I get an egg-timer for about a second and it =
> disappears. A quick google did not find me mention of a variant of =
> sasser which killer Task Manager.=20

This is far too little information to make a Sasser (or any other!) 
diagnosis from.

Some adware/spyware is taking to task-killing much as most successful 
viruses do.  Of course, Task Manager and like programs are usally on 
the lists such functions use (Task Manager can also be prevented from 
running via policies but I believe you normally get a distinctive 
warning message if this is the reason Task Manager doesn't run).

Adware/spyware can also explain all manner of web-browser (at least IE) 
weirdness.

What you have described could be caused by all manner of (combination 
of) things.  Do more diagnosis (I realize that is hard over the phone, 
especially when the tools you want to use apparently can't be run).


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3267092