A Sasser like worm on our network, almost gone but still there.

A Sasser like worm on our network, almost gone but still there.

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
A Sasser like worm on our network, almost gone but still there. RedPenguin 04-29-2006
Posted by RedPenguin on April 29, 2006, 1:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Ok for a while we had a Sasser/Blaster like worm on our network which gave
the machines a minute to shutdown after crashing lsass.exe. Now it's almost
completly gone and McAffe had pretty much ridded our network of it.

Now we have a machine that has Windows Server 2003, we updated McAfee, it's
the full version, and ran a scan, but something is still crashing lsass.exe
giving on a minute shutdown. It only happens if the machine is on the
network. McCaffes buffer overflow protection is on and it's on-access scan
is on.



Posted by =?Utf-8?B?UGFuZGFfbWFu?= on April 29, 2006, 2:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
My reply is at the bottom of your message :


"RedPenguin" wrote:

> Ok for a while we had a Sasser/Blaster like worm on our network which gave
> the machines a minute to shutdown after crashing lsass.exe. Now it's almost
> completly gone and McAffe had pretty much ridded our network of it.
>
> Now we have a machine that has Windows Server 2003, we updated McAfee, it's
> the full version, and ran a scan, but something is still crashing lsass.exe
> giving on a minute shutdown. It only happens if the machine is on the
> network. McCaffes buffer overflow protection is on and it's on-access scan
> is on.
>
>
>


Do you have firewalls on all machines to make sure it won't get into the
other ?
Are Windows Operating systems fully updated ?

Scan your computer(s) with :

Kaspersky Labs free online scanner
http://www.kaspersky.com/virusscanner

Panda Software free Active scan
http://www.activescan.com

Both these scanners generate a log file when they are ready. Please , save
this log file on your Desktop, for example and then post it here so we'll
understand what you have on your computer(s)



Panda_man




Posted by David H. Lipman on April 29, 2006, 2:44 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Ok for a while we had a Sasser/Blaster like worm on our network which gave
| the machines a minute to shutdown after crashing lsass.exe. Now it's almost
| completly gone and McAffe had pretty much ridded our network of it.
|
| Now we have a machine that has Windows Server 2003, we updated McAfee, it's
| the full version, and ran a scan, but something is still crashing lsass.exe
| giving on a minute shutdown. It only happens if the machine is on the
| network. McCaffes buffer overflow protection is on and it's on-access scan
| is on.
|

I asked specific questions in your previous post. You failed to respond.

I ask now that you answer my questions !

What worm ? This needs to be stated.

What version of McAfee VirusScan ?
Can I now assume, based upon "McCaffes buffer overflow protection" that you are
running
ViruisScan Enterprise v8.0i ?

As I stated, LSASS can crash w/o a virus.

Is this PC with XP SP2 ?

Is KB835732 installed ?
http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en

NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code
-1073741819

{ see attached }

If you don't have the above NT AUTHORITY\SYSTEM shutdown message or if KB835732
is
installed, it can be a hardware problem or IOS corruption.

You need to define EXACTLY the parameters of the PC and the crash.

You have not done so in this post either.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


begin 666 LSASS-Shutdown.gif
M1TE&.#EA&@'[`/<```0"!(2"?$1"/ PF;(@"!"1"A*'"Q+PB'+1"1&2#M,@"
M!,1N9- 2%*2BG*Q>7!P>''1B7,CBY*1Z?'ZBS,PB)(QZ?.@"!$@"!-R&A,PR
M+.@2%)S"[(2EU+P:'-Q"1'1V;*@"!,D*#-Q65!<6%'!65+QR=$1BG-SU]%1R
MI)22C!PV=#12C.P:'*36U'.2Q-RFG(^RW(1J;.0,#,R2E.PR-+D*#"0"!*B"
MA.XB)-Q:7)0V-,1*1"PN+&0:'-Q*3(Q&1,3"O-8"!' "!+<"!-8*#.1R;#Q:
ME/PJ+!0N=.1B7,0:'*RNI-#J[)R\O+K:W)!R='Q>7$QJI.SV]%QZK/@:')>Z
MY/0Z--!*3 P*#%!.3(P.#*PL+&R,O,123/0"!/@2%"0^A'N:S(AN;/R4E%PN
M+/Q*3.1J9(R+A)@"!"Q*A*C*S&QN;$P*#/R,C(BJU/I25"P:%"0^?-2VK/P*
M#*R*C/PE)/Q:7.1^=,RZM,1>7!0"!!0J=,D&!-P6%&1D9/Q]?%D"!-3.Q*RJ
MI"PJ+,P[/.0N+"0.#/RDI*PR--QV;/R#A/Q$1&1>7-3Z_#PV-,W*Q+RVK/S^
M_$PV-+R>E)QF9/QT=/QE9/QL;*3*[)R:E+0Z/-R:E/R:G+R&A*PC)"PB)'Q>
M9,3.S,Q"1#@"!-@:'&1.3)QN;+E*3,125!P:'(2"A'QX='1:7$QFI%5TK)R6
ME!TX?#A5E)2VY#0R-$->G+2PK/L[/#!,C(RNW,2^O)1J;$1"1*S&Q&2&O,PV
M-.Q25"02%,QV=-RJI-R6E/PT-.Q.3.1V=-SN[,3>W)QR=(Q:7%Q]M!P.#+PN
M+&R.Q'1B9-32S.Q:7'P"!-1>7.3Z_*3*]-125 0&! \J;"Q&A-06%,SFY)Q^
M?.P&!.06%*3&[*@&!,8.#$9FG.8>''26Q)2VW+P.#*R&A.PF)#0R+.1.3(1*
M1-8&!+D&!-H.#/LN+!8R=-3N[)1V=$]NI/D>')R^Y,].3/<&!/P6%'R>S/M.
M3)0&!/Q65/D.#/I>7,2^M"'Y! ``````+ `````:`?L`!PC_``-!&TBPH,&#
M! 4B7,BPH<*##QM*G$BQHD6*$2\Z')A1X\*.'ST:5$@28B@!T"*I7,FRI<N7
M,&/*G$FSILV;.'/JW,FSI\^?*U7M2@GMD5&!2$-!"Q0*Z5*G"3DN?0IU:5.I
M@: J':AT:]:J4YV*#1MU;$FL9$$69&HV+=*J4,4^;/MVZM:K);-"##L66M>N
M=/UR9<O7;EFT><EN1*K*4<I'`R)+'K 'FV4DV# C@8=D\V9X\&"!#JT"ENG3
M1FB9@#Z]^G1QXEJ)B[)]>Y1YW^>)_Y_GBCQY%*[23TF_S-6R*>^7Q9>?8%G]
M^KT2),C/97\O+O_]YPP7`P[H@C/DN)"@@N20$X:##9*3CX1AY&/AA?E,P(&&
M'&S8H1L<@.@&+B..B L,;L!P(@PLLEA..;+ 6$X5--983Q7UY+A!/3OV^ TF
M&WSS3368$$DD)D@FJ2221@:BB@"!1 +-9))A0YEEE<&3&3:<=0F::&"65MIJ
MJK7&&FRP91.';=FTZ29NM^S&&V_!$3?<<+'DF6=RS3'GIQ'432>="=F9H)UV
M4;02Q:+?->I*>.6EEQYZKJRW7GOQP5>???;MIU]^O? 7(!>D#LB%"Z=R08ZJ
M"#+(H(-AQ/^:3X457LA!/K=ZR"&((;KAJZ\DHJABBRW*`D.,,=(X(XTW\JBC
ML]$&:V0U/Y8S;789JOMD)A (]1C5%IYY9::=>;9:%^2=AIJJKEF)IJRU5;;
M??EY"N"H_Y5*X*G.H$I.JQ$^^."$*-=ZX02XXJJA&R_WR@&))I8H[(K&OBAC
MLC7BZ'./T/(HI+1&WB0`D:%4@)*45$9FV9658=;E9^F""4MI[*9F9FNRK2FO
MF_76.^>]OQEWW)UZ\AF=<@)+!VAUA1[J7<*-CO<HPY*J)[%[[DW_?-_%GH*:
M0'\`%NXQJ2*KZH*"KI9\<JTJMZRKAQV&:#FP)@Z[8HOE'"MC%3S_7,6.S@8I
M;3V84)MZ-5+69=:31$(3P%"10!;N`-A41BZY7J(;YM59E_F::_""G8U*<,8Y
M9W# E7UV+"K]&_!S@ (Z*-P%'\P=H^(E'.EY#J^G-Z839WIQIX%KS+''IAXX
M\N*OF@SAA+1B:*&&''HHXLPE]A_LYIU#UN=ZQBP<E0Y:IDO=D(84B:1@I2E-
M$4J1G 0EID6F);K;0[DX<RZ5A.9+6#,-F5A#O-C$JR7'BP1N<J.\Y=TB>L^#
M7B2:`[ ^1:=Z)KC>=0R5G>THBGN0@A1Y__(&,4N13SZ<NE@OEK%$]16N8P4J
ME8)4I;@$1:A!)IN5%C&4*Y=1CE<B^A4NQCA&%FWN6#!X4;*6Q2P=C:YTT:I'
MM3:0.B2U3G85P(LJ`C"0`!RM6[,#UP!4,ADL7:9<5%.):$*SKD::B81<>XU*
MV)1"%MX+7S(<3G'T%#V ,>>&?J*%#L7!0X,AS#L*Z][W',9*\?%M"N7SV_D^
ME;Y0/9%4B,/E@1BWN 4]"%;SBUR&)/>RF/VJ1,%*4>:(M3,8A:Z .3J@Z:8E
MI&HPT"D!4$4$5:$2)^T":8&TH!0B@;L]4$8EF$$G$E@"#Y:(QIVP: D85M(U
MV4P2;"WA#?)>J/]"EABG)<UA"7-40@N5F,"@+9$;$+MG-_$T3%(HL%2E,#4?
M)-X'8X$C7,?81Z#$C<R*6 RIK"P4N5SACW(?ZI48251&8K$H9VLD8+,V\$8?
MR7%:=!12D>XHD !48(\J64ICKD5!0;;$,BK1(#K1V24/AD:1Q$5&$QSTBP
M1B4F1&$E^<E5?LH0.#+,4_14$M!(%-2L!$5H)*:CDH,A+&'@"0_#T$,I%O
MHA4#'!/UD[XGCBJ7(',?XT Z/PDY:(L8.FF'C DBFME,F<-*8QH%*(LJL-%G
M.:HICWQ4+6NR3BRAR&8W(_C'I.TB2E.*S#A74AF6=(:=[90J:%P25=?_J*0U
M*JEG`5"(O!1R=07(@R%P(_'/&9+UK,A5ZT$CD9VV^I!1=',H>:+PT+S!$F)Y
MG<+?MMM74>$RBB%+58*J*-)@(M9"79S<Y51:,S)&MEAI_-QE;T13:=X4IPJT
M(UFRN4<]_E%VM+/=9%2"U)5D9ITKB>V7%!E"J&*UJL2+5VTF.4FN[G.LD2A;
M)S&LG+2^9+F$4DD/MX=*N4HW4G2%&'9A:3Z+Z6>O@@O5^G#IL57U\L8E*^QY
MAVG2$.4OC)@35HK..%D97=9&;X0C9ZGEV09.1;21V.-4*K"+(CWB241I6E)S
MITXN;<:#BIRM5-?UX-O&(;=IFI=O>QM<%5J8_[C#V;!QS6H$@M9YK6=E:R1:
ML5R%-JIN"BO/$(E81/CTS:+TX53&-#:XOWZL0")#$,E"&DS(<=&+B@6R&)&Y
MHC/"=$;/C":.: HT:DGK1]:ZHRJXV3HI4S!VX;1=2YRV!W1F!K:QC<13W:G(
M,UNUJO!JR80CD1N5[*8EQ%E)G/UY9[)&Y[@&!;$X1*R]$H-'T.:A5%TCQK?Y
M6&RO^ D<J&ZI2U*MBHJ#99#\*G18868(I3&['.9.]#_.O;29!*01Z8 6)*&=
MNLEOZ>945!+:*E?#FZAM6CFQ86MS3<UW'S1-"%5#57<-KWAJOHW8YI2O.@D'
M;6GS)-MNF,.![="4T/^-;D,;]K!"MSB)?\N8X&X)Q>^B"GZ\=) +Y(>R':<7
M?V#L%4N1F:+WWEN-,+*LC3*[[\W*\=0YU2]3_$*8J7MS2$YR3.V:9J4"DTLS
MO:L:UK VPJT-3TU?NTUMX+2;2S*/./Q*CO1L2/+H$(R4<D/4]@"],!3KS:XK
M-I]>9;Z?_OQ50*FZN:1[>44(\=S=N*+<KF36V,?2VZ6>BZE,Z2O-H766@3]5
M106R&?J?FOZ_X4PMURL3-:EU)NQ@8N3$5Z.UX8$A7I1L$YQ8R''A%.?C><)3
MOVCH'%!:S^2$(I3>Y\;WE4]*4N*+):(OVJD8-WI4IB*0@426<P6M6V4JZR+_
MRU":4J+_[T1%YYRQDA5J9C7==#<]]>H$L OZV[_^^+\_UK&\]::9TS);\G5A
M!T*,M"ZN47$DU#5HEWNZEPUMQW$=]WMWTB]I0W?,01W'EWREI!UO%5<+,U>L
MI#=]TVV"%W.T)"J.=C@W=RKPDR"_A$4G<UCV,WX<<E)AI%(TPU+O92SQ%2,S
M<F3U95_1<FH+5"1&:"1'F(3@=%H6M'I08RY0B"X1!SR-U"Z0]!JWAWMJQG80
MB"_/@R<56$/&)THZ='*'DBC0]8$@2&A[(WA(!#@GZ!\=LU&/%E@X1UC?9VDK
M@VF54SEA-'1D5$9GU$RR4%F;]RP]L@&*6"TZQ2U(_^A92GB$1>5D@5&):7&)
MEIB)F+B)FMB)G/B)GAB*H#B*HEB*I'B*I@A:J9>*J-B*K/B*KAB+L#B+LEB+
MM#B+_&>+NGB+N]B+O/B+OAB,P!B*3X):PGB,PXB,RIB,S+B,RDAE*=&,TNB,
MTUB-U'B-S;B*V+B-UMB-W/B-WD@7_!>.X%B.Y'B.YBB,!8=:Z-B.Z>B.\/B.
MF)B+B/\FB/^$B-]'B/_)B/_MB/R/@ME B0_UB0!'F0G9@T%808"-F0!OF0
M#1E.$#F1#EF1^%AP1$&1&FF1''F.X]B1(+F1(DF-Z\A3(7F2)SF2O*B-*FF.
MG=B2,"F+^YB/%7F**7F)-_^9BD+!C@BI%_[XDCG)%YH8E$FA-!E9BX4!BX=A
MCS8)E,AHBDN)B>C8BRRIB[[X%:[3CT YE#[IBGV1&"_Y%4^QB>^(BPM9BR]0
M!';P!OJ@#V7P"V:P"7K1B@!0EW4I$ `@%GDYEF91BH$Q%7MIB8$)BGAIBH/I
MDZ5HEW<)#8>9E.68%GG9F($AD*9X![90!I90"7^@"']0"9; #[9P!-. !XD9
M%HTY%60I%Z@9"*>9&'PYBDLAF:89FTT)F8H!EK<)F6F:EIE9;H%E@1F0EI
ME";YFYM #(N0F6W "8=P")S0!HIP"?Z@# #PO D($QF('I.E_9E7)1F$))
M%>+_F93="9[>"9A9D9=]*91]J9[BB9ANT19[.1#"F97GZ9W=Z9BJ*99QX9/"
M>8H2B8I%< 3Z< E_, ;-V9S/J0B>:0=E$)J^\ ^HN)V1"0"TR9J'B:&QF9ZQ
M::$8FIYUV:$5RI<>NIB[6:(:RII(4:$?*IPFJIA\`:,86J(7ZJ(>JIM?P9LS
MNJ(O&IAV*1<]JIX^*J) &J(J>J.6>&5GJ8E)0 SZ8 E_T 9C,*5M\ >=>0F7
M8 EVH ^+0 QU0 &UT(G:N9<N:IZ,69ADJJ)GFJ;IJ:9IBIYO"IXLNJ8KZJ9H
MFJ8^ZA1YNJ=R^J%G"IF*V:;JJ:8Y:J>#JIWF*:AU>JC]_WFDA#J*E$F8T& ,
M1[ (_F"@F^F9_% &BU &^L /_/ &#VH+[T /!U +I(BD>[JANEFCK*JB,WJ7
M-,J:L_FH=?JJ_^FHL)JK.DJK*_H4O5JF9?JJM6J:L2JD=HFK@6JLP)JL1RJB
M1MJLLNJKL+D*M .;+T /E^D/EF )_L /74H/5( /]% 'Q$ ,MF +Y_H.Z, "
M.O /F8BH&YJG8R&D;<JJ;XJ>N[J;=5JO]^JH\]JG?$J?>JH0_TFGPGJK>NFO
M\VF>>?JGK]FG^&JG'%&P!)NKHQB@E1@(-/ .B]"691 #,5 '_= /]V !]Y"R
M<T %C* ,=5 'Z( #I, `4/ (H/^HJHNZJ\;JJT9JKR@JJ*Z:L]2ZKWS:HC5*
MJ/4YM(QZJ+B*JV:!I $+M(JJJTHKM4C;KU6KJ% ;&$K*DX&!`3CP#NEJ"T_@
M!$Y@"A;@!1:PMFD;!"30! ;@`./*`J30!UJ0"??)K [KIHVYF'^*EP_[HW\:
MIX/;MW%*IO^)IU?+F(++HXO9N(&;LWJ+GHSKHX(;I/5JN2^JIR8*F#^*L998
ME6U1".AP!,3P#A+@!"H1`93 MFL;!*Q@`"K1`B7P!2S0!PP0#J4`!-CXKT_9
MN[XKD@4ID* H!PR `Z5;!],0`=2PNLD0!*\+!;*[$B+0#>Z0N^'0`RDPC9T+
MC+%(EXW_&Y2MR(V-$8V<& J)0 KC0 _L>P_JL TKP002$ 1!\ 1JP!+%8 $R
MX XA$ [AL ]^8+/-V+M>^;W3N(RA:(VS8XR!H0[:X TL0 54T X 'QL!+'
M0 ?G$ $LH0Y!P Y$0 0A4 ,U``X"``E7*977:,"YN9B\#*.+[5^)&!D0':
MP `,H $:( ,6$ 2$P 0QX0$*\,%$P <AT XU, 2?D D%K)>8N+6_F\# Z<2_
MFK=?&:/!.YLI;)^2"J3J*+IIH03AX [NL,/N0+]!( KPZQ(^H !NS Y\P ?M
M2V.)YA .(1#"[L .]#O$.]"\+$$(;NS&?* `<3P$X- .AG &*@R?6$FB8YG*
M\?F>]ZG*_/G"?<F=0DFA5/&=M[F;Q+JP6[NQKHR?7+S*;V&KN[B3Q9D6'5 #
M[1 "(< .F#S$"D 'J[42,_#)H#P$0P`"( `.IRR?$GNYB=N5-JJ7X@RXFCNG
MD&NYWGFY?AJK%KO.=WFBB/O.9,&K?FJOE.NH/>JX>UNYCOO(I5B^`]D6S<#,
M<<P'["#-8J"Z+7$"W# $GZS-W P":, ,JO#$1[NJ`&NL/<NO43NPSPJK(ZVC
MOWRD*#JDD@NP53NOO0RL'(&L+MW2*/\]T]O)TDG+J\<(QF+1!:4\!'$\Q$/P
M#+P`$TSP!!*MS=N,!FA `,!P!N"<L&@*HEF)S_I*IV<ZU2&]K/)JSM,:M7]+
MIUK]J.XYSGW!J'\[SOMLU>X)SUBMF%9]BS.)B<'PTQ*M`$- `M.K$H1@#RP1
M`6*@U-R,!B @! ^0`D_,S[1JTVKJT55,FS8=TXM=THC1U9"-TY--H9F=V5JL
MJS<:HS):M*H*K(O+LS'-V)T-Q:E8DJ"(!V@`#B"@U!!0U"OA`;%M#R<0OT]0
MT4R-!J.0#@VPB9&KJ(-+SJ6=U0"[M(7*ILF]K_J*V6@]U5-+ULN=J/L<L/AZ
MF/4LVB3]L(G_G-._2,.<> `5#0+R<+\K80^QK<T[D-LJT0@W8-%-30!ZD 6D
MF=C*.JLJC=U*ZZR:&]!(V\="JA?S;/.6J-!JMT]&[2]K-/&W*)(VZ$`?J%$
M"JU??*V6&-^$#0);$ HK(0KK'=L@@ #'L!*(P-0$@ : , (?<(\"S9XO'HYZ
M$>.V^.!$*51+0XJ>(-\<KA([P,W;O,W<C `JX0GS30`$``".$-SMJ-H$#K7]
MN*S,&*TQ*1;%*"6C. D@D.),C0"HL.'E;=$@D >:@.1F/@HCL :^5TX;V*
M7.4!23N=2 D6S>5,+>;EC>)F+@T$``A8( ""@(I_.>B/Z8F$.<NB_TC+-SZ+
M"GF4F?@#31WIO3WI>H[D? X(`) .J.R)B,R)5GR*PUJ8ZUFP;:[H<&VFA%KJ
M-&ZQ<-X6&DN*D&[F2#[?1V[I!" -F#X(`2# GUBL5ZS'4F&+]7G9BTRM>>SD
MJ=Z:C/S25.SKC R5Z-BUR5R)4" -M6[KTI#M?"X$HW -Z1 `:W[HKZK+]DG,
MGV[+*XW<X<GJPAS6_KK/Z+Z:,S[,[I[(_#G,H\Z=+CR-Q"N*9T &0K#G`D\`
M0G !`# "69 "O%Z)_OW.#9_@(MJL5)S2(PVM_ERKSIJBW>OK(VK@13JO* KR
M(-JS"\ZS*#WQ",[.VP@-UNKHJ%@+JR );/\`"$)0\T(`"!=@`]?P`+NP"F&:
MJHL:IX*JN%'KV?$\U;EZM=&-U<W]R&.*]&;JLT3?W/RMUNI\]']+W*NNBPL\
M[:2X!*K " (P"X-0]NFP"XP0`$NP\#>+Q2F/SQZ*TOZMFPFKHTX+UXY]M!3^
MM"!=TD]+VE6OLU9;]Q&>LR;=\,\>C$KJ\O#8L&G=V'!OL(W-Z@%+^)2+U:]Y
ML)$KW*P^[&U]R"NMUIA/^-Z-L!U-K]O(T^^HW$4?^=-=G]I=Q2ZZLU2+LTL[
MTQJML+PII#OK^K*ZH:]_V2%OJRJMW$.KCTS8D.Z<W06.N(\KX)T/]9Z+N<RZ
MSNFNL(^/K)G[SU__[?S.WZ_%W>"Z?\[DJW6+[NDVWNK%OIJ!W)N_^8^J#Y-2
MWI%;:<C[+NA=K.B(3I!7?O[NJ,@``2V00((##1(LF##A06@+%QYD"-&APHD-
M)5YTB%%CQHRA`NR"%HGC1I(C399$>5(E28.!4KHLV!)FRY@69\:\.=/E2YP9
M9>*$N)/GT)4950D(693H4@`7`11LJE1@H*@NJXYL:O I50!=KVJ%&I:K5ZMB
MQU;UVA7LV:9?V\;T*M"M7+5TR;*5"_&KU*4%5>T*)++O8+YY%6J-J/#J7J=H
M#S(V/#!K9&B+'TN>&=4RU9:.H7(FZ-@M:-*5+\/52UBU*D<A51=^F;JG_U69
M0:E^IIF;Z]2M<C.V7>L[..B\MQ$3-][;>.2MRJ-^%JY<K&&H:*6_YODQ*7;8
M"X'7;0N\,GC-=<\^)FNZM'C+#L6OSWQYI^;366F;#IVZ/>><[R?+QNPF\SK
M;K"CMBLP0?V:XZRYJ6AC$$+$>$/,P0HC6ZXSB[)R#CJKTK(PNK2.$\[#XNS2
M"RX"23LOK^A,TCP 2#$3O_&KQOQ/+(\BQ T^C+[\?3&+(/R/LP"S+ JOAK
M;[\DGT0R2HLH<Q*S[[A;ZD :L2SPQK<:W#"Y%$N\S<6R)MQM.-[2HB[##M=Z
M+CG<WIQ.33=K(M.Y@<1BL$:^_D*0R\&\! TX"?_Y$_)(]0H=C:XAH3142B?I
M@\E(_*K$3[]*'RV24Z$,LU30DU@+S$\;2?LRU;B2&W!5N]#RKL[KYFIQ.#U?
MM35/[YQ"T<2Q4M2*S=(R-%4E[;8L5E1E?4VVV66?=58I+:.%5M 5J<6VVFRI
ME;%4;;_=%EQQPR47I6G'1;=<==-E-UE D6TWWG7GE;?>A5ASC5Y][>5W7WT_
M\M;??@<6N&!EM20X88,75G@H&0-E..*&):88HG,KQGABC04.)9"C2LTXY(U'
MGK<"D"(A.6615];V6)9?5CEF4Q&&N6:9;^:K6WAMYAEGG^]%:N>?A^[9YG>+
M)CKIGO%%&6FGE9898*'_GZ8::H9IMCKKJAE^>&JMO]X:W8O!)IMG@W6>LFRU
M61X8Z[ G6GOCM/<=^^V@$(J;X4_K?3?O/7.SF^*&!M\WE H$"#CNQ++66*B]
MYW4YX65KTGIN9?LB//-VZ[;7\AH7[T[OG0Y3J?2Y3W(\=7K[%IVGHB@O<"F)
M_-3=AMN_W!T1^?/7/?YPUEE1D]9Q?$*#62Z#_8(>.)>8Z^`EQVQWO]5:]6
ME3?>^(=2YQ[RDQ.^;G",8JUH6.(YHHQ78/$^/R7?44750_^F:[.BWW.^B(
M&=-IMOQR&AWTHC>[`$8/2HC:G0%S,A6@?$HT:,K4C?ZWJ=TUD'O=$Q?K!J8G
M_QY9QRWI&8NC0I@F$*[)17UJ$(=6M<+HI'!]>WK?`UW$'/BIL"NOLM_]=/@M
MPR%.) S[#WNL-)\A14J(9N(/?'Y$'QG*$$>7XHJ4;*,Z)RZIBD6$GP4ON,5M
M'0M\G^'0"5U50QT=254ES.(3<60<,$GH2K :'_ZVTL8[08@WOWFA#O58.VAQ
MSE^6H91X&(@D(4W)2$<<Y/\F0RC\%%)(;]Q4(K=(2$&VQY%[.1&&)KG)"CY+
M@P;C8 N+A)LUMG&.J9K/G,JT1K5$J)0.BLZ&V ?#^XVR4Q-\RBT#=)M;[M&7
MA(-6\(9',$ B:4?6NUZ4TN/!Y%&*28:RH0V)2)LDVO\GB9N_6*I)8/<6@^
MW*P>)R69%+G#0^F4ZU;E.=K;3G>WTI/[JIQUM.>]G/O4I3F=]<IZO
M>6= !3I0@A)44#U,W#GIN4^&-M2A#]UGL<SYS] 5U*(7Q6A&Q5>CKBE44! %
M:4A%.M*9!8VBA-%H2E6Z4G5RYQ$?\YI'E3)2FM;4IO?TTT1EBCF6]M2G/]WH
M:DZVT]C=U*A'1>KT5M.:IIWT=4"%:E13NAH?FNU;2<5J5FV:("_:#%Q2!6M8
M+;J4CAT-9PE:B5;5NM:0PH9I%:.5)/GB/K'6U:[NS%)5&]:HOX4.=+5A:V %
MB\_"^%-?WK&._P"8NP1B)!3_#7DL-"([6<A65K*6I>QE-9M9SF+6LYO];&=!
M.UK1EC:TIR4M:A/RB)/T$&+HZA@T'M$?ZP2KMHZBWHC&(\#!]M:WG"0(:XTU
MU'BI(@"J0"YR*V1*(C+Q>&HT8B \DESJ5M>ZUN=K6[7>YVU[O?!6]XMWO<
MIHX$IG2+1'K5FY\KL<5'""RC&.NB7OK6U[[WQ6]^];M?_O;7O_\%<(#[JXJ8
M#L2LJQ.:A6#YP@6_Q4SM(ZK2"-S:P[VV7!-VBC%W*41O=LK#1-Q6A-45@ )#
M0VKHQ:/A4LVS9GA==ZEE.U]=+R:L2/&2PQEB*9+A&/BMU:G8:DPMW;)+
MQMDB_["Y](I@U&VMQ^3"L$D.S*XDFR1L1X86C?MZ$=?FN)\%KAR6H_7CDIRX
MN$/NW>76)69/HAEH%L;Q2'A'.QZSN9PEGO*ZHHS,&YI/-8-!7I/M+*@]=^1P
M"14R5N(SU^>!SLJD*YV\SEEHC 3YPEY[T]TN$N@C-5:!C;6=ID,MUVJ5K<HD
MN7&X*&VB\-B6MDJ23'EB?4QNAF:9Q\SMBD48K4GC>9A,UHAS&#1*.(F)B<4Q
M99Z66\-E,S=$:OZ:X0K<910'>]$I1.,B86W,^'J30D-43R%;;"GG<6=EA2&S
M22P=YV#+#SFQ8A*<?#,G7<UPE>^IGZ1*+;(L3=O,P$ZQ,O^K*1]9JP>:S=4P
M+@N%\"$>ZN"\)AFZ?XAJ>0)<?<RQ"V+OR&(1*3A/*W1UKF^;)@5Q.F/]5C*<
M5>WE07&IW 5#7),F'6;N0OB+XTD<,7&WB?W"?\EHJT*5QQ*I<XQ&E.*X31
M^==98DSBPU7YMU:-NX\J5G>D/@Q,L%X8U%%=U.(R^==7,O6"H.W,*1X1%O'H
M;27=Q=;@L7;U,L5806,$A,M\%+@@$W.I_'A41-=S@NM(P[7C5DS"81&^-15+
M`L(N?5.RW"EKR*PMPTTJ=:+[`DNBY;]''<F"9]Y^',.H2 91WVD,5;A_LFDI
MHX9/<&*FX5>DS8ZSY.=#(;M!J'UV:S<:^$!Z^&::9'Q7D[^0'-[PPB/(UR;*
MY.#D9GAT^=YXGF2?(.M>N:+UCZ/Y&5M7\%VN+QFD6PD^%(HF:"*3-"H.%#H+
M91M 8>$F[1F@ZRL*&JLY\UJRWNL^[^,_^$$5;P.5OWD@Q:.2^C"CA L2MFN(
M,$J(0Z(D"(J31JH4(+&\RF.Z,O,USZN6[+,FQNB1XE.^@4,\-\D516&E#UE
M,;$C8V.X_CC"#SO"XW V$)O 3?N3::LPEG.7F-(M]H-!?=NM#UJ1'J&>%'R.
MQ? ,O(.B_]V:-0)A#P\JN"A:/_";-?H[GZ<K,]X+O!C[G&3QL\O#/8D1.P4:
M%7\C+HLK%CJK0:F ,4:S0H4A'3M,";^C.!VDEE/SPSY\Q,,*1,G)/)0SB9?*
MP,#SJX=H.I3J1'H)NX6)1 6QOX' /ZES,Y2X.,U+*^58Q5R,'0&41 S9.6H9
M1#:J0 *[0!L[1 W\O<H[Q=.Q.Z:;N_GS'(181!.9"!(DQ(0CB:N@O&54QMEY
MCM>A1/-R!)QCMV0$M022)$UC$0#*D+#K']>CNE!;$G:T1LH!%N71M'FD$)]P
M1]N8(UN4",ZK1"TDM 3#M59"R"&JM5NK0UQ)DN^(/B:ZNV0:C_^&/(^'2SB(
M="'KB;6&;*4)J;60^Q6'1"..T#V.R+-$4Q\/8SR('$+FDA '3"$D>L)F\Q)D
M(Y0(:4E6>K9APPE4LC<"9*17,A<L'$65_+WLT; .!!4>:4,).D'1Z$)*62*G
MA ZE-!/X@R07Q(TY%")L_)^')*.2O(A7-+%C),653!MO8D+1"!,4FC<B?+ G
MJHZX5#Q:F8NL/!.]?)'@XQ.[E!/@BTL:>HJY'+M9] O 0\K4&#@Z?"2;C+>&
M@X\H>B"':\Q-T3:V3)0GNI8T5+_)/#C+I$Q%@<+--!38,XH2^[>B:[<1\CBF
M9)4^<S$XY,C^8R%LB[Z1C,T6.SP`43#_!93#V%0P54&LW(3 1I0(3.0RCT'+
MQ42KC="7EU,-Z<S$06Q%+@E'&V,J]-(Q.:,7ZF0*$S$7K3.UQ!(#"3'_".*
M\HE&0+2RDO"H34Q%[,Q!@IP9Q$2>*1HUI:J]_=R>KKO&RZZS3%@S%*2VPS
MU$'#`_3((LN4]3 /",7'%NS"H9 =V+@209L]*?(3LUS-/<2*`1D.Z/+-V5P+
M;#O17RS"U['!,($TIB"6..JKDR@W%>6(\[0QQ<RYDOC!O)L[*Q*]/>G1%>31
M(1&[4-.-UEN]1TP>/]//=[3")7&/OCA)C$C)2T.)'_25Q%LV&CI!G*11,,I-
M$Y(3$K(A%!E#_U%2(Q?*N#+%1=DDH0H13X-X182R3RPQRR$=EEK[426RR!\E
MRQ;,#.<B37!#OT4YHO%[3#0$-\X$P^8;RKY3S>;<4<0ROHWS,\E;0'<33#OI
MN;$<0WGS0*6,-PK92KFDHU/E5!*U48R@,2"CU'+<",]8PX@@MR*C53(4TB(5
MRQ@4$&KR3!E<PV)251^II Z4TH5KU'K$0:4[KS/+4BGLR53*5'?[TH'+1OE!
M5!@*HSB%R60C#KO42UFBR0:3Q@Y[RP^)T<-,N3NMD3Q%#UV]NPQ[DA):4 [U
ME 4$IV]"DR@"U@@$5L?IE Z<IF<:V&M25R'-0L2I6X4EE]LE^ZC_^[TB@\
M.$HLE;-DA0U:9![K6T64]5G"P%&:1= OL[)O1,6BM44.]!S>@MG!XJKZK#9^
M_,<JK#TH_<G;6:QVS WI\-FN+9 Z/31WQ0ZRF\I 4DA\Q+OK850VQ"WRD+4(
M;5J8=:M)'5H##;B;-+9G>Y#PF$L]:4Q[V]M2I26O_=DK%-FRU%&();_,1-8=
MPQ7&?=0*90ZKG,>XE=O<\S6,_;S?>,MTS24P:9/"!-W1C9,^&< S$=U4D4;"
M)5SL.U"Q=47!.Y3(I-T>;,+HFB8H#,THM-S_WG5=J(/=U9A%-MFMP2G,REA!
MX\T<-CG>PB3>Y%W!&XI>Y0U#Y$W>XV7=UCU,6-7<'00SWP7?\.6G29PX#*S;
M+83/[%7?]86G0FS7J&4]?^;V@0N3>X/W:J6'?_>7?==*(4%!.H<5?`Q$:
M^C7@`U:=2H-::,VA_G7@!\:?>[G8`9[;[4'@"@"09>^(7@#O;@^]$^C\%/
M@4BUC-U8#$9A`TZ("LA<"@;%P?W@&/9@.GW=:DOA&TYA$J9;%[Y"&?;A'];A
M^U6Z,4,9'#;B#)Y9Q,V7S1&O)G;B)X;B*);B*:;B)AYACTG<<!&P+>;B+O;B
M+P;C,!;C+E8)DUEBZHU%8S'[T$%+XYUR&S:&X[!AV3:.X[@I83K&XVC#8I"I
MXSP.'#.^8C_N8YPAV4$69*,QJ4,V9*@Q.T5VY*SIJD5^Y**Y8TFV9(FY.1Z^
MY$UN%F$*B5!XA(X19>DBY5$VY5)&Y5-6Y51FY55VY5:&Y5>6Y5BFY5FVY5K&
MY5O6Y5SFY5WV953^&.,2YN,BYF$VYF)&YF-6YF1FYF5VYF:&YF>6YFBFYFFV
MYFK&YFO6YFSFYFWV9FC>A5T0`'$FYW$VYW)&YW-6YW1FYW5VYW:&YW>6YWBF
8YWFVYWK&YWO6YWSFYWWVYWX&:'D." `[
`
end


Similar ThreadsPosted
How to find virus/worm/trojan on network client September 21, 2005, 11:29 pm
my network server has a virus and i can not conect to the network. November 1, 2008, 6:19 pm
Sasser virus January 11, 2007, 9:05 pm
Sasser & Blaster indication but no detection June 24, 2006, 11:45 pm
Worm VB.AS Aliases W32.Alcra.B and W32/Alcan.worm!p2p July 18, 2005, 8:37 am
WORM/DELF.FPV - new worm?? January 14, 2008, 6:58 am
Cannot use network after Sobig November 1, 2005, 9:57 am
Network goes down every six days at 5:00 PM July 20, 2006, 3:09 pm
Norton and home network October 4, 2006, 4:05 pm
Possible network intrusion - Cant trace IP! August 14, 2008, 12:39 pm

The site map in XML format XML site map

Contact Us | Privacy Policy