Hello Folks,

Regarding the Sassers worm, many of the machines on the college network were hit, and kept crashing/rebooting with the Error Msg along the lines of ... has exprienced errors with the xxx/lsass.exe service. Shutting down in .... . I used the patch provided by Microsoft, and the Sassers removal tool from Symantec. http://securityresponse.symantec.com...val.tool.html.

Given an infected machine, I first install the patch, let the system reboot and then run the removal tool. It always comes up saying the sassers worm was not found on the system. Does the patch take care of even worm removal? If so, why would Symantec even put up a Removal tool? I'd like to know if anyone tried using the removal tool before installing the patch.. me's just curious. Thanx