Gone in 60 Seconds

[Scann69]

I've had this problem many times and everytime i get this, i'll have to format my PC but sadly last nite i formated it and after connecting to the PC the 1st time, i got the same massage. Can somebody help me with this? I believe that some files or programs that i backed up has the virus so even after formatting, i still get the problem. I've done a full virus scan by NAV but no virus was found. Please please somebody help me with this problem.

Thank your in advance.

[overXposure]

on most of the computers i have seen with that error have the sasser virus ...

there is a patch to resolve the issue that allows the comp to get it .. and also a free removal tool from most of the anti-virus companies ...

[stan03]

get the thing from here
http://securityresponse.symantec.com/avcenter/tools.list.html

[johan851]

It may be possible to abort the shutdown command as well. Access the command prompt (type "CMD" in the run box) and type in "shutdown -a" without the quotes. Might be a temporary solution to give you more time to fix it, if necessary.

[IZON]

I read somewhere (in the piles of computer mags strewn across my study) that some chap realised sasser relied on the rigs clock. I can't remember if he was refering to the BIOS clock setting or the windows clock setting. Anyway he played around with the clock (he went back an hour or two) and eventually when sasser appeared instead of his rig shutting down in minutes he was able to extend the shutdown time to several hours, which gave him more than enough time to log on, download the patch and clear the virus. Hope that was helpful :) - I'll root around for the article and post a verbatim.

[Scann69]

I'll like to thanx to all that has replied to my SOS. I finally got the worm out of my system. Currently updating NAV and it has already pass 20 minutes yet my system has not restarted so i guess it's been fix. Big thanx again and keep up the great work guys.

[Oni]

Originally posted by IZON
I read somewhere (in the piles of computer mags strewn across my study) that some chap realised sasser relied on the rigs clock. I can't remember if he was refering to the BIOS clock setting or the windows clock setting. Anyway he played around with the clock (he went back an hour or two) and eventually when sasser appeared instead of his rig shutting down in minutes he was able to extend the shutdown time to several hours, which gave him more than enough time to log on, download the patch and clear the virus. Hope that was helpful :) - I'll root around for the article and post a verbatim.

Yep, I did that. I love Windows sometimes. It says it's going to shut down in 60 seconds, so I roll back the clock and it says it's going to shut down in 30 days :)

[overXposure]

Originally posted by Scann69
I'll like to thanx to all that has replied to my SOS. I finally got the worm out of my system. Currently updating NAV and it has already pass 20 minutes yet my system has not restarted so i guess it's been fix. Big thanx again and keep up the great work guys.

glad that was it :) the first time i ran into it, it was very aggrivating...

[patrickholliway]

My grandmother is having the same problem on her computer. Except, her's only show's up when she signs on to the internet with dial up. Does the same when she hook's up her phone line to try to update her McAfee antivirus.
Firtst thing that I told her to do was get rid of McAfee.

She has not been able to get online to get a patch and she is a couple hundred miles away so I have been at a loss on what to instruct her to do.

I will play with rolling back the clock to see if I can get her to do that - she's not very good with the computer so instructions are not easy.

Is there a string of sasser that is only affected while online?

any other suggerstions??

Thanks,

[Permanoob]

Most if not all of the sasser strains disconnected you when your computer attempted to connect to the internet. Which makes it a real crappy problem for those with broadband. But my brother that does tech support for MSN said that was it's main characteristic.

[Eye_Carumba]

Norton AutoProtect with automatic Live Updates has kept me virus free for ages and ages. It may slow down your system a bit, but it saves a whole lot of hassle.

[9mmCensor]

Originally posted by patrickholliway
My grandmother is having the same problem on her computer. Except, her's only show's up when she signs on to the internet with dial up. Does the same when she hook's up her phone line to try to update her McAfee antivirus.
Firtst thing that I told her to do was get rid of McAfee.

She has not been able to get online to get a patch and she is a couple hundred miles away so I have been at a loss on what to instruct her to do.

I will play with rolling back the clock to see if I can get her to do that - she's not very good with the computer so instructions are not easy.

Is there a string of sasser that is only affected while online?

any other suggerstions??

Thanks,

If I recall their is a debug option. If you pick that and leave the debugger open, you can connect to the internet and download the Sasser removal tool. Then run the removal tool and get rid of it.

Sasser is a worm that sends itself too other boxes, so a good firewall is what you want to have running.

Only reason I got it was because my mom managed to turn off the XP firewall somehow. tsk tsk

[patrickholliway]

I have a computer at work now that has the sasser virus and is giving me fits. When the message came up I was able to roll the clock back, that was pretty cool. What wasn't was when I downloaded the removal tool from microsoft and ran it, it states that the worm is not found on this system. For some reason his computer wouldn't print screen or else I would have saved that and sent it to microsoft with the two of them up there together. Anyways, I went to symantec and downloaded the removal tool for sasser and ran it. It too states that the worm was not detected on the computer.

I have yet to cleanly get rid of the Sasser worm and naturally no one backs up their system so I need to save these files.

Any help?????