Firstly, it was my stand alone laptop that I was trying to finish some work on before meeting a friend for a drink at the hotel.
Let's see, I was in the hotel before dinner and was watching a live feed from Fraser Downs, my triactor was looking good and the field was pacing as predicted when I got the 59 second shut down error. The race was 2:01 so I missed it! That's where I got pissed off.
SO I reboot, same thing after a few minutes. Some reboots lasted long enough for a quick Deja search and save to favorites. Then I'd reboot, hit favorites and search for my answer frantically. Sometimes it was during log on then it would be OK for 10 minutes.
I read about BLaster, didn;t sound right but i managed to run a BLaster fix which found nothing.
Another issue was related to service pack upgrades or the security level being change, not applicable (ooops reboot again).
After a while, I managed to find some info from MSKB about renaming and extracting the original lsass.exe from the Win disk. My backup was at home and my copy of Win2K was there also, (this machine only has a restore option from the partition so I have a burned Win2K disk for such file extraction needs).
I managed to get an emial out to Colin asking for the file but without being able to stay online it is hard to continuously check email especially from somewhere 8 hours ahead, thank god Colin's a night owl.
Needing to get work done NOW, I performed (the computer did anyway) a complete rebuild and I was onine in 30 minutes. As the drivers were being installed by the setup program, it asks to go online and check IBM for the latest, at that point the error started again.
Once again, I reformatted and restored,as it wasn't properly setup. This time all the preinstalled drivers went in fine and I didn't log in to update. All was fine whil I got my work done and I went online again to send it to my client, as I pressed send, the 59 seconds started again (NOTE: Colin HAD replied in this time already but it was too late and he could only find some XP files that probably wouldn't have worked but I had given up before then anyhow, THANKS AGAIN COLIN!!).
I called the reception desk and the night guy, who probably didn't know how to change the channels on the TV he was glued to put up a bit of a fight but eventually called the manager and had him contact their IT guy, (I went to the bar).
On the way back up to my room, the fellow at the desk pulled his attention from his TV long enough to tell me that the IT guy had found a problem in their server that was tracking usage and performing the SMDR for the CDR call accounting system, so he rebppoted his server and routers and all seemed OK. I assume it had been hit by this worm and he will probably be fixing it now if it is reinfected already.
As for myself, everything is working well EXCEPT micrsoft. First I could get to the patch description but not the file. THen I couldn't get to the KB articles at all and now even the homepage won't work. Have they been hit too even though they know about the vulnerability or are they just being hammered by users trying to patch?
If anyone's got this file on disk I'd appreciate a copy by email ( ozmedia@xxcite.com ) but if not, I'll just hope for the best and wait.
It seems to be a relatively simple single key regedit if you are hit now anyway.
