cancel
Showing results for 
Search instead for 
Did you mean: 

How do I clean an XP sp1 machine that shuts down too fast

N/A

How do I clean an XP sp1 machine that shuts down too fast

My nephews machine has become infected with the sasser worm (I presume). I've got the tools to remove it but he says it shuts down before windows starts and continually reboots. How do I run the cleaning tool?
6 REPLIES
N/A

How do I clean an XP sp1 machine that shuts down too fast

try this while the timer is counting down

Start/Run
Type "shutdown -a" ENTER

Ian & Linda Jordan
N/A

How do I clean an XP sp1 machine that shuts down too fast

I won't have time to look at it until tomorrow but from what he tells me it doesn't even get to the desktop. If hes mistaken I'll try what you suggest. Thanks.
N/A

How do I clean an XP sp1 machine that shuts down too fast

There are instructions for the removal at...

http://www.microsoft.com/security/incident/sasser.asp

or a removal tool at...

http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displa...

If it really doesn't stay booted long enough to enter the shutdown abort command, then try safe mode.
N/A

How do I clean an XP sp1 machine that shuts down too fast

have just recieved this from "F-secure",and must admit it means nothing to me,but someone may find it useful,and understand it

About the MS04-011 workaround
-----------------------------

One sideffect of Sasser worm's spreading is that it crashes
LSASS.EXE which forces Windows to reboot. This makes it rather
difficult to fetch and install the required security patch.

A simple workaround can be implemented to prevent LSASS.EXE
from crashing. The following file must be created with Read-Only
attribute set:

%SystemRoot%\Debug\dcpromo.log

where %SystemRoot% is the Windows Directory (typically C:\WINDOWS
or C:\WINNT).

Since the MS04-011 vulnerability is in a debug print code,
if the debug log file can not be opened the vulnerable code
part will not be executed.

Hope it helps

Ian & Linda Jordan
N/A

How do I clean an XP sp1 machine that shuts down too fast

Thanks for that. Can anyone remind me how you set 'read only attributes' from the safe mode command line?
N/A

How do I clean an XP sp1 machine that shuts down too fast

attrib +r %SystemRoot%\Debug\dcpromo.log