GoodMorphing

Advice re: possible worm???

▼

Advice re: possible worm???

September 17, 2003 3:23 PM from

Suddenly IE won't work at all. I have tried sys restore. Cannot access online virus scan. Norton not finding anything at all. I was thinking about re-installing from disc, but if it is a worm or virus it might wipe out the disc. What should I do?

word works, defrag works, sys restore works, netscape works, trillian works.

If this comes through underlined it is not intentional...

28,340 views 187 replies

Reply #51 September 17, 2003 5:09 PM from

WinCustomize Forums Top

That Gateway internal modem has to be disabled......

Reply #52 September 17, 2003 5:11 PM from

WinCustomize Forums Top

would that be therough the control panal add remove.

Runing that worm search now, kona.

Reply #53 September 17, 2003 5:13 PM from

WinCustomize Forums Top

Control Panel/System/Hardware/Device Manager

Reply #54 September 17, 2003 5:13 PM from

WinCustomize Forums Top

I run it all the time. I got hit with sobig twice. damn thing screwed up IE something fierce.

make sure you run both. My norton did not pick up the virus either, I had to run the program you are running to rid myself of it.

Reply #55 September 17, 2003 5:16 PM from

WinCustomize Forums Top

To disable a service go Control panel > Administrative Tools > Component Services > Services(local), right click the service then choose properties and change Startup Type to 'disabled'.

Reply #56 September 17, 2003 5:20 PM from

WinCustomize Forums Top

The internal modem is disabled

worm scan still running

Reply #57 September 17, 2003 5:23 PM from

WinCustomize Forums Top

Make sure you kill the modem process too......assume it's SK991ODM

Reply #58 September 17, 2003 5:23 PM from

WinCustomize Forums Top

The other day there was an MSN article about yet more MSN patches needed to be applied for another blaster worm they expect out soon. I applied that last night, but I used IE even this morning, that couldn't be the thing could it?

Reply #59 September 17, 2003 5:23 PM from

WinCustomize Forums Top

nope........

Reply #60 September 17, 2003 5:24 PM from

WinCustomize Forums Top

um, if I kill it and it happens to be the keyboard, what would I do then?

Reply #61 September 17, 2003 5:24 PM from

WinCustomize Forums Top

no worm, by the way

Reply #62 September 17, 2003 5:25 PM from

WinCustomize Forums Top

you run both scanner programs?

Reply #63 September 17, 2003 5:25 PM from

WinCustomize Forums Top

GM
that one item listed, Isass.exe
is usually a result of a virus

"Added as a result of the RATSU.B VIRUS! Note! - the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"

Reply #64 September 17, 2003 5:27 PM from

WinCustomize Forums Top

GWMDMMSG and SK991ODM ?

by Scribe Fuzzy Logic - 9/17/2003 5:06:56 PM
The first is a Gateway modem and the second is a Gateway keyboard proggie.

I should kill which one?

Reply #65 September 17, 2003 5:30 PM from

WinCustomize Forums Top

not yet kona, will get it now.

Xerraire - 9/17/2003 5:25:57 PM
GM
that one item listed, Isass.exe
is usually a result of a virus

... what should I do with it?

Reply #66 September 17, 2003 5:31 PM from

WinCustomize Forums Top

Just a side note:

when I use XP on a system i usually go into msconfig and turn off everthing but essential services. So when it is all said and done, 10 or less things actually run when I start up the PC.

anyways...

Reply #67 September 17, 2003 5:31 PM from

WinCustomize Forums Top

Its a result of a trojan
Here is a page of what to do
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.b.html

Reply #68 September 17, 2003 5:32 PM from

WinCustomize Forums Top

lsass.exe is a MS system file....you'll have to guess which process to kill.....feel lucky???

Reply #69 September 17, 2003 5:34 PM from

WinCustomize Forums Top

goodmorphing:

this will kill ANY and ALL viruses and find them of course:

http://housecall.trendmicro.com/

Reply #70 September 17, 2003 5:35 PM from

WinCustomize Forums Top

wow... its going to take me a long time to understand all of that.

Reply #71 September 17, 2003 5:37 PM from

WinCustomize Forums Top

try my link. click on scan now...it will find and kill any virus!

Reply #72 September 17, 2003 5:38 PM from

WinCustomize Forums Top

kona i tried that first thing, netscape has a problem downloading the needed components.

... let me see, does this feel like a lucky day....

heh

Reply #73 September 17, 2003 5:39 PM from

WinCustomize Forums Top

well... if you don't hear from me for awhile, i killed the wrong one.

Reply #74 September 17, 2003 5:40 PM from

WinCustomize Forums Top

GWMDMMSG is the modem. The pc will run fine without it. Lsass is the Local Security Authority Service and is normally running.

To check for Ratsou open regedit and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run to see if HID.exe is there. If not it's not Ratsou.

[Message Edited]

Reply #75 September 17, 2003 5:41 PM from

WinCustomize Forums Top

ODM is killed, and keyboard still works

Welcome Guest! Please take the time to register with us.

Richer content, access to many features that are disabled for guests like commenting and posting on the forums.
Access to a great community, with a massive database of many, many areas of interest.
Access to contests & subscription offers like exclusive emails.
It's simple, and FREE!