LSA Shell Export

D

DK

Hey.

I am getting a message that says something about an LSA
Shell Export error. I click "do not send report"
or "send report" and after about a minute, a box appears
that has an extremely similar interface to that of the
MSBlaster virus, that says that the computer will restart
in 60 seconds. I've updated all the MSBlaster patches,
and it still occurs. Anyone else able to help me??

Thanks heaps..

DK
 
C

Carey Frisch [MVP]

Apparently, your PC has suffered a major security breech and is now
infected with Malware ("The Sasser Worm") because:

1. The latest Windows XP Critical Updates have apparently not been installed......
2. The PC's firewall apparently has not been properly enabled.....
3. Out-of-date or no AntiVirus program has been installed......

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Follow these directions to remove The Sasser Worm from your computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]


What You Should Know About the Sasser Worm and Its Variants
http://www.microsoft.com/security/incident/sasser.asp

PSS Security Response Team Alert - Sasser Worm and Variants
http://www.microsoft.com/technet/Security/alerts/sasser.mspx

W32.Sasser.B.Worm Critical Information
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

W32.Sasser Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

3 Steps to Help Ensure your PC is Protected
http://www.microsoft.com/security/protect/

Frequently Asked Questions About Antivirus Software
http://www.microsoft.com/security/protect/antivirus.asp

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

Consider purchasing a top-notch Internet Security program
that will help protect your PC from future viruses, hackers, and
privacy threats:
http://www.symantec.com/sabu/nis/nis_pe/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

----------------------------------------------------------------------


| Hey.
|
| I am getting a message that says something about an LSA
| Shell Export error. I click "do not send report"
| or "send report" and after about a minute, a box appears
| that has an extremely similar interface to that of the
| MSBlaster virus, that says that the computer will restart
| in 60 seconds. I've updated all the MSBlaster patches,
| and it still occurs. Anyone else able to help me??
|
| Thanks heaps..
|
| DK
 
M

Marc Liron MVP

Hi,

With newer Sasser Worm varients appearing I also
recommend you use a Trojan Scanning
tool to make sure nothing elase has been placed on your
PC.

Why?

The Sasser Worm did not have this as part of its code,
HOWEVER the newer varients could
be written to do more than the original worm!

A FREE online Trojan scanner is here:

http://www.trojanscan.com

More on the Sasser worm at:

http://www.sasser-worm.com

Kind Regards

Marc Liron
Microsoft MVP
http://www.updatexp.com
----------------------------
Get Your FREE XP Newsletter!
----------------------------
-----Original Message-----
Apparently, your PC has suffered a major security breech and is now
infected with Malware ("The Sasser Worm") because:

1. The latest Windows XP Critical Updates have
Click to expand...
apparently not been installed......
2. The PC's firewall apparently has not been properly enabled.....
3. Out-of-date or no AntiVirus program has been installed......

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Follow these directions to remove The Sasser Worm from your computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]


What You Should Know About the Sasser Worm and Its Variants
http://www.microsoft.com/security/incident/sasser.asp

PSS Security Response Team Alert - Sasser Worm and Variants
http://www.microsoft.com/technet/Security/alerts/sasser.m
Click to expand...
spx

W32.Sasser.B.Worm Critical Information
http://securityresponse.symantec.com/avcenter/venc/data/w 32.sasser.b.worm.html

W32.Sasser Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w 32.sasser.removal.tool.html

3 Steps to Help Ensure your PC is Protected
http://www.microsoft.com/security/protect/

Frequently Asked Questions About Antivirus Software
http://www.microsoft.com/security/protect/antivirus.asp

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

Consider purchasing a top-notch Internet Security program
that will help protect your PC from future viruses, hackers, and
privacy threats:
http://www.symantec.com/sabu/nis/nis_pe/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

--------------------------------------------------------- -------------


| Hey.
|
| I am getting a message that says something about an LSA
| Shell Export error. I click "do not send report"
| or "send report" and after about a minute, a box appears
| that has an extremely similar interface to that of the
| MSBlaster virus, that says that the computer will restart
| in 60 seconds. I've updated all the MSBlaster patches,
| and it still occurs. Anyone else able to help me??
|
| Thanks heaps..
|
| DK
.
Click to expand...
 
B

Bruce Chambers

Greetings --

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/



Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
G

Guest

Once the 'LSA Shell Export ' messages appeared and my computer began shutting down I went to Microsoft Updates and downloaded the critical updates, enabled my firewall, and anything else appropriate. I checked the task manager for virus codes and used microsoft's analyzer. They said I did not have the virus. Now when I start up my computer the 'LSA Shell Export' window opens and won't close unless I click 'don't send'. Is there a fix
B

----- Carey Frisch [MVP] wrote: ----

Apparently, your PC has suffered a major security breech and is no
infected with Malware ("The Sasser Worm") because

1. The latest Windows XP Critical Updates have apparently not been installed.....
2. The PC's firewall apparently has not been properly enabled....
3. Out-of-date or no AntiVirus program has been installed.....

If your computer is constantly attempting to shutdow
or reboot, quickly go to

Start > Run and type: CMD , and hit enter
This opens the Command Prompt window

Then type: shutdown -a , and hit enter

This should halt the rebooting problem

Follow these directions to remove The Sasser Worm from your computer
http://www3.telus.net/dandemar/sasser.ht

[Courtesy of MS-MVP Jupiter Jones


What You Should Know About the Sasser Worm and Its Variant
http://www.microsoft.com/security/incident/sasser.as

PSS Security Response Team Alert - Sasser Worm and Variant
http://www.microsoft.com/technet/Security/alerts/sasser.msp

W32.Sasser.B.Worm Critical Informatio
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.htm

W32.Sasser Removal Too
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.htm

3 Steps to Help Ensure your PC is Protecte
http://www.microsoft.com/security/protect

Frequently Asked Questions About Antivirus Softwar
http://www.microsoft.com/security/protect/antivirus.as

Special note if you use AOL

America Online installs its own connection settings that overrid
the ones that come with Windows XP. America Online'
connection settings don't include a way to turn on Windows XP'
built-in firewall

Visit the following web site for instructions on downloadin
a FREE firewall program for your computer

Ref: http://www.updatexp.com/free.htm

Consider purchasing a top-notch Internet Security progra
that will help protect your PC from future viruses, hackers, an
privacy threats
http://www.symantec.com/sabu/nis/nis_pe

--
Carey Frisc
Microsoft MV
Windows XP - Shell/Use

Be Smart! Protect your PC
http://www.microsoft.com/security/protect

---------------------------------------------------------------------


| Hey
|
| I am getting a message that says something about an LSA
| Shell Export error. I click "do not send report"
| or "send report" and after about a minute, a box appears
| that has an extremely similar interface to that of the
| MSBlaster virus, that says that the computer will restart
| in 60 seconds. I've updated all the MSBlaster patches,
| and it still occurs. Anyone else able to help me?
|
| Thanks heaps.
|
| D
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

what is LSA shell (Export Version) 2
LSA Shell Error 1
LSA shell 3
lsass.exe 7
LSA Shell (Export Version) 2
LSA Shell (export version) error 1
LSA SHELL 2
LSA SHELL (Export Version) 3

Top