Help

[Guest]

Please I need help with my computer, since I got my connection to the internet I’ve got a lot of trouble I can not even stay on internet for 1 minute and writing this report is very hard.


When I turn my computer on, it sometimes gives me this message:

“Generic Host Process for Win32 has encountered a problem and needs to close we apologize for the inconvenienceâ€

Then, when I connect to the internet it gives me this one:

“This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shut down: 0:59

Message:
Windows must now restart because the REMOTE PROCEDURE CALL (RPC) service terminate unexpectedlyâ€

And tada! My computer restarts itself!!!!!!

I think it may be related to some of this programs or files:

• Lssas.exe
• LSA Shell (export version)
• Lorraine.exe

And if that is not enough, there is another one that I could not copy but it had this:

Status code – 1073741819


If you need any more information, please contact:

Alan Herrera
(e-mail address removed)

 

[Ionizer]

Please I need help with my computer, since I got my connection to the

internet I've got a lot of trouble I can not even stay on internet for 1
minute and writing this report is very hard.

You may have the Blaster worm:
http://www.microsoft.com/security/incident/blast.asp

 

[Mitch]

Sounds like you not only have the Blaster Virus, but
perhaps some others,
what I suggest doing is updating your computer with
Windows Update, (constantly)
and investing in an anti-viral program and perhaps a
firewall, (there are many free options out there.)

Go here download and install;
http://www.microsoft.com/downloads/details.aspx?
FamilyID=2354406c-c5b6-44ac-9532-
3de40f69c074&displaylang=en

If that doesnt do the job, go here next;
http://www.microsoft.com/downloads/details.aspx?
FamilyID=e70a0d8b-fe98-493f-ad76-
bf673a38b4cf&DisplayLang=en

Cheers,
~ Mitch

 

[NoNoBadDog!]

You connected to the internet without a firewall and without a reputable,
updated antivirus program. Until you have both, you will continue to
encounter such problems.

Bobby

 

[Guest]

ok i have thelssas.exe worm
I have done almost all to delete it (i copy the information from here) but now i have a problem finishing the proces

When i put run: regedit32 it doesn't wor
and i still got the lsa shell export version error messag
did i miss something

and how do i get some firewall or antivirus?

 

[Guest]

what free options are you talking about?

 

[roger]

Hi Alan,

ok i have thelssas.exe worm
I have done almost all to delete it (i copy the information from here) but now i have a problem finishing the process

When i put run: regedit32 it doesn't work

You're using the wrong name, it should be Start > Run > regedit

and i still got the lsa shell export version error message
did i miss something?

Turn on the firewall, download stinger and this update:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

http://vil.nai.com/vil/stinger/

and how do i get some firewall or antivirus?

321050 Description of a Personal Firewall
http://support.microsoft.com/?id=321050

You can get a free firewall in www.zonealarm.com
and a free antivirus in www.grisoft.com

Sasser worm:
Mitigation Steps for Affected Computers
If your computer is infected with the W32.Sasser.worm,
please do the following:

Enable the Windows XP Internet Connection Firewall or a
third-party firewall on the affected computer.
Disconnect the computer from the Internet.
Restart the computer. If you have problems rebooting,
reboot in safe mode.
Press CTRL+ALT+DEL.
Click the Task Manager.
Click the Processes tab.
Press and hold the CTRL key and then click
C:\WINDOWS\avserve.exe and c:\WINDOWS\system32\*_up.exe.
Click the End Task button.
Click Start.
Click Search and then search for and delete the following
files:
C:\WINDOWS\avserve.exe
C:\WINDOWS\system32\*_up.exe
Click Start again, click Run, and then type: regedit32
Click OK.
In Registry Editor, locate and delete the following
registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run "avserve.exe" = C:\WINDOWS\avserve.exe
Connect the computer to the Internet.
Go to the Windows Update site, and click the Scan for
Updates button.
Download and install the critical updates recommended
after the scan.



http://www.microsoft.com/security/incident/sasser.asp
The stinger tool may also be helpful in detecting and
cleaning the Sasser worm.
http://vil.nai.com/vil/stinger/

Download this update
Microsoft Security Bulletin MS04-011
Security Update for Microsoft Windows (835732)
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Enable your firewall.

MORE ON SECURITY:

Three steps you can take to improve your computer's security:
http://www.microsoft.com/security/protect/

321050 Description of a Personal Firewall
http://support.microsoft.com/?id=321050

More info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html
http://www.bullguard.com/antivirus/vit_randon_i.aspx
http://www.vsantivirus.com/sasser-a.htm

Good luck

 

[Guest]

this seems to work thanks trully!!

 

[roger]

You're welcome, Alan
Glad to help.

Keep up a firewalll and updated antivirus.