Hardware Analysis Community Forums http://www.hardwareanalysis.com/content/topic/22253/ 2009-11-07T18:49:45-05:00 http://www.hardwareanalysis.com/content/topic/22253/ /images/halogo.gif text/html 2009-09-25T08:34:17-05:00 Antonio Stevens http://www.hardwareanalysis.com/content/topic/22253/?o=20#565992 Ha you do realize this post is 5 years old right? text/html 2009-09-25T07:52:28-05:00 alex france http://www.hardwareanalysis.com/content/topic/22253/#565988 Hi all, <br /> <br /> i had the same pb and finally found a solution :<br /> It happened to me, when the flag of the Video card used, has changed in the bios setup.<br /> <br /> In the bios : 2 choices were available :<br /> <br /> 1°) Internal<br /> 2°) PCI video card<br /> <br /> The choice was on the second, and as i'hadn't got any PCI card : it wasn't coherent.<br /> <br /> To sove the issue, i put the choice on first option ; Internal; <br /> And until this, my PC boot without any pb.<br /> <br /> Hope this could help.<br /> <br /> Alex from France<br /> <br /> <br /> <br /> text/html 2004-02-29T19:51:41-05:00 angryhippy http://www.hardwareanalysis.com/content/topic/22253/#109077 Victor has a point. Where did the kill disk come from? What make are your hard drives? Most manufacturers have software available for doing wipes on their web sites. I use maxtors'. I have used it with IBM, Maxtor, an old Quantum Fireball and WD drives. text/html 2004-02-29T19:30:54-05:00 Antonio Stevens http://www.hardwareanalysis.com/content/topic/22253/#109076 Yes I did a one pass of zeros on each erase. I went ahead and checked the xp disk that I have and it does have a &quot;Lsass.exe&quot; on it. Notice the capital letter. So I guess thats not where it came from. This is interesting. It amazes me that some people sit around just trying to find ways to make things horrible for others with these viruses. text/html 2004-02-29T13:17:44-05:00 Victor Hackney http://www.hardwareanalysis.com/content/topic/22253/#108987 Hello Payton,<br /> Thank you for the birthday greetings,<br /> and all participents on this subject<br /> <br /> When Antonio used this&quot; Kill Disk&quot; three times, where did he get this KD program from,... Is it possible he downloaded it onto a disk??? and the lsass virus was downloaded with it onto the disk??? and he is re-infecting the hard drive again???...just a thought.<br /> <br /> Best wishes to all..... and Antonio, hope you sort it out soon.<br /> VicHack text/html 2004-02-29T11:35:59-05:00 angryhippy http://www.hardwareanalysis.com/content/topic/22253/#108974 not a clue Did you do a full zero fill or just a quick directory wipe. It could be in a program on a CD that you reinstalled? text/html 2004-02-29T10:29:34-05:00 Antonio Stevens http://www.hardwareanalysis.com/content/topic/22253/#108956 I use AVG actually. <br /> <br /> Any idea how this virus could have survived kill disk??? text/html 2004-02-29T10:23:13-05:00 angryhippy http://www.hardwareanalysis.com/content/topic/22253/#108954 Go here and do a dedicated trojan scan. See if it uncovers it. What anti virus program do you use? I posted all the various names. Try doing a google search and see if you can find one that cleans it. Or you can try AVG or EZ Armor. Ez isn't free but it has a 12 month free trial so..I guess it is free huh?<br /> <br /> <a class="ext" href="/action/r/http://www.my-etrust.com/microsoft/index.cfm?" target="_blank">http://www.my-etrust.com/microsoft/index.cfm?</a><br /> <br /> <a class="ext" href="/action/r/http://www.trojanscan.com/trojanscan/trojanscan.htm" target="_blank">http://www.trojanscan.com/trojanscan/trojanscan.htm</a> text/html 2004-02-29T10:02:10-05:00 Antonio Stevens http://www.hardwareanalysis.com/content/topic/22253/#108949 My only question is this...<br /> <br /> I used killdisk three times on my hardrive and I got this lower case lsass error. How could this virus survive that? <br /> <br /> Also, I don't use norton so how can I get rid of it? text/html 2004-02-29T09:57:20-05:00 Antonio Stevens http://www.hardwareanalysis.com/content/topic/22253/#108947 Whoa.. it is lower case...<br /> <br /> Let me see if I can get rid of it. text/html 2004-02-29T05:33:40-05:00 angryhippy http://www.hardwareanalysis.com/content/topic/22253/#108883 <a class="ext" href="/action/r/http://www.sysinfo.org/startuplist.php" target="_blank">http://www.sysinfo.org/startuplist.php</a><br /> <br /> Happy Birthday Victor!<br /> <br /> text/html 2004-02-29T03:50:18-05:00 Kevin Toal http://www.hardwareanalysis.com/content/topic/22253/#108865 Way to go Peyton, ...How'd ya find that out.?? <br /> text/html 2004-02-29T02:11:07-05:00 Victor Hackney http://www.hardwareanalysis.com/content/topic/22253/#108843 Good work Payton,<br /> It would appear that Antonio did not clean up his Hard disks and reinstall as he said he did<br /> <br /> At the time of my post, I understood the words&quot; killed both&quot; disks, to mean he had done a clean install<br /> This may be an &quot;americanismn&quot; I was not familiar with,<br /> <br /> Norton makes it clear where the most likely &quot;(site)&quot;s are where the hacked Lsass was used in lower case . named lsass.exe came from,<br /> <br /> Thanks for clearing it up<br /> Kind regards<br /> Vic Hack<br /> <br /> <br /> text/html 2004-02-29T01:30:45-05:00 angryhippy http://www.hardwareanalysis.com/content/topic/22253/#108818 OK you're dealing with two different things here so listen carefully. If the file that is being mentioned is the Lsass.exe with a capitol L that's fine. It's legit. However.... if its lsass.exe with a lower case L then it is a RATSU.B VIRUS!<br /> Also Known As: Trojan.BAT.Passer.a [Kaspersky], IRC/Flood.bat [McAfee], BAT_RATSOU.B [Trend], W32/IRCFLood -G [Sophos] <br /> Type: Trojan Horse <br /> Infection Length: various <br /> Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me <br /> Adds the values:<br /> <br /> &quot;HID.EXE&quot;=&quot;%System%\HID.EXE&quot;<br /> &quot;lsass&quot;=&quot;%Windir%\Debug\UserMode\lsass.exe&quot;<br /> <br /> to the registry key: Go to the symantec site for cleaning instructions<br /> <a class="ext" href="/action/r/http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.b.html" target="_blank">http://securityresponse.symantec.com/avcenter/venc/data/backdo...sou.b.html</a><br /> text/html 2004-02-28T22:58:35-05:00 Kevin Toal http://www.hardwareanalysis.com/content/topic/22253/#108778 Antonio, have you tried aonother copy of XP?? maybe the file didnt copy right.