Bruce said:
Window appears saying: LSA Shell Export Version encountered a problem
and needs to close.
Then another window says: c\win\sys32\lsass.exe Status code
1073741819
Then there is a countdown and the computer shuts off.
Please tell me how I can eliminate this annoying problem.
Thank you.
Bruce Stokes
You have a variant of the MSBlaster and/or Sasser worms. Apparently you
do not have a current version (not earlier than 2003) antivirus
installed using updated definitions, are not keeping your operating
system patched, and don't have a firewall.
To stop the rebooting, go to Start>Run and type "shutdown -a" without
the quotes. For information about the Sasser worm, go here FROM A
DIFFERENT, CLEAN MACHINE:
http://www.sarc.com/avcenter/venc/data/w32.sasser.worm.html
Get the worm off your system and then immediately patch XP:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx -
TechNet bulletin with download links
http://windowsupdate.microsoft.com
Your computer is probably infected with more than just Sasser, too. Here
are additional cleanup steps:
1) Take the infected machine off the Internet and any lan immediately.
2) From a different, clean machine download Stinger
(
http://vil.nai.com/vil/stinger/) and run it in Safe Mode. Stinger is a
limited virus checker, but its advantage is that it is standalone and
doesn't need to be installed.
3) Hope that Stinger cleans up the machine enough to be able to
reinstall your av or install a new, current one. Update its definitions
and do a full scan.
4) Continue the cleaning process by removing any spyware with Spybot
Search & Destroy (
http://www.safer-networking.org) and Ad-aware
(
http://www.lavasoftusa.com). These programs are free, so run them both
since they complement each other. You may also want to run CWShredder
and HijackThis from
http://aumha.org/freeware.htm. Although CWShredder
is no longer being updated, it will still clean older variants of the
CoolWebSearch malware. Be sure to update these programs before running
them. Always read the instructions before running a spyware removal
tool. It is best to run antivirus and spyware removal tools in Safe
Mode.
5) Make sure you are running a firewall. DO NOT CONNECT TO THE INTERNET
UNPATCHED WITHOUT A FIREWALL.
6) Go to Windows Update and apply all security patches for your
operating system. Do not install drivers from Windows Update.
Malke
