"LSA Shell (Export Version)" error - critical

[Diande]

On 1 May after going online, my pc started warning me
that my pc would shut down within 1 minute, which it did.
It brings up an error message that says there is an
problem with "LSA Shell (Export Version)"

I don't know what that is, where it is, or what it's for.

The pc freezes since then and nothing loads under 15
minutes almost, and it shuts down automatically if I get
online at all. Some sites don't open at all.

The ONLY thing that helped was a system restore, but then
going on the web to check my hotmail account today, it
happened all over again.
The antivirus did a complete scan and found nothing.
I have done the system restore all over again, but I feel
like I'm walking on eggshells till it may happen again.

Need some HELP please.

Thanks,
Diande.

 

[Carey Frisch [MVP]]

Apparently, your PC has suffered a major security breech and is now
infected with Malware (i.e. "a viral worm") because:

1. The latest Windows XP Critical Updates have apparently not been installed......
2. The PC's firewall apparently has not been properly enabled.....
3. Out-of-date or no AntiVirus program has been installed......

If you have Sasser, follow these directions to remove it from your computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]


What You Should Know About the Sasser Worm and Its Variants
http://www.microsoft.com/security/incident/sasser.asp

PSS Security Response Team Alert - Sasser Worm and Variants
http://www.microsoft.com/technet/Security/alerts/sasser.mspx

W32.Sasser.B.Worm Critical Information
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

W32.Sasser Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

3 Steps to Help Ensure your PC is Protected
http://www.microsoft.com/security/protect/

Frequently Asked Questions About Antivirus Software
http://www.microsoft.com/security/protect/antivirus.asp

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

Consider purchasing a top-notch Internet Security program
that will help protect your PC from future viruses, hackers, and
privacy threats:
http://www.symantec.com/sabu/nis/nis_pe/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-------------------------------------------------------------------------------------


| On 1 May after going online, my pc started warning me
| that my pc would shut down within 1 minute, which it did.
| It brings up an error message that says there is an
| problem with "LSA Shell (Export Version)"
|
| I don't know what that is, where it is, or what it's for.
|
| The pc freezes since then and nothing loads under 15
| minutes almost, and it shuts down automatically if I get
| online at all. Some sites don't open at all.
|
| The ONLY thing that helped was a system restore, but then
| going on the web to check my hotmail account today, it
| happened all over again.
| The antivirus did a complete scan and found nothing.
| I have done the system restore all over again, but I feel
| like I'm walking on eggshells till it may happen again.
|
| Need some HELP please.
|
| Thanks,
| Diande.
|
|

 

[Manuela]

Sorry, in such a case it's essential to format.

Courtesy of spanish MVPs:

From: "JM Tella Llop [MVP Windows]" <[email protected]>
Subject: Re: Pregunta tonta acerca de LSA
Date: Sun, 2 May 2004 20:37:18 +0200
Message-ID: <#[email protected]>
Newsgroups: microsoft.public.es.windowsxp

se aconseja formatear y tomar las precauciones dadas aquí:
it is advised to format and to take the precautions given
here
http://www.vsantivirus.com/02-05-04.htm

From: "Enrique [MVP Windows]" <[email protected]>
Subject: Re: Pregunta tonta acerca de LSA
Date: Sun, 2 May 2004 20:38:22 +0200
Message-ID: <#[email protected]>
Newsgroups: microsoft.public.es.windowsxp

Pues ahora se trata del virus/troyano W32/Sasser. Mismo
método que el Blaster: formatear.
Is the virus/troyano W32/Sasser. Same method that the
Blaster: to format.

 

[Carey Frisch [MVP]]

Sorry, *** IT IS NOT ESSENTIAL TO REFORMAT!***

W32.Sasser Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

---------------------------------------------------------------------------------------


Sorry, in such a case it's essential to format.

Courtesy of spanish MVPs:

From: "JM Tella Llop [MVP Windows]" <[email protected]>
Subject: Re: Pregunta tonta acerca de LSA
Date: Sun, 2 May 2004 20:37:18 +0200
Message-ID: <#[email protected]>
Newsgroups: microsoft.public.es.windowsxp

se aconseja formatear y tomar las precauciones dadas aquí:
it is advised to format and to take the precautions given
here
http://www.vsantivirus.com/02-05-04.htm

From: "Enrique [MVP Windows]" <[email protected]>
Subject: Re: Pregunta tonta acerca de LSA
Date: Sun, 2 May 2004 20:38:22 +0200
Message-ID: <#[email protected]>
Newsgroups: microsoft.public.es.windowsxp

Pues ahora se trata del virus/troyano W32/Sasser. Mismo
método que el Blaster: formatear.
Is the virus/troyano W32/Sasser. Same method that the
Blaster: to format.

 

[Bruce Chambers]

Greetings --

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

You needn't be polite, Carey. "Manuela" is a troll who's been
deliberately posting the same malicious advice using at least 6 (that
I've counted so far) different aliases.

Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Antonia]

thus I like: giving 'good advice'. what other tiny beasts
have entered inside from sasser?
when they violate your PC to you, to see if you will
continue giving to those advice note who you continue being
a useless one.

Courtesy of spanish MVPs:
From: "Antonio Amengual[MSMVP]" <[email protected]>
References: <[email protected]>
Subject: Re: [HOAX] Formatear despues de cojer el Sasser
Date: Tue, 4 May 2004 12:09:27 +0200
Message-ID: <#[email protected]>

asi me gusta dando "buenos consejos", que otros bichos han
entrado aparte
del sasser?
cuando te violen tu pc, a ver si sehuirás dando esos consejos
se nota que sigues siendo un inutil

 

[John S.]

Hi Manuela,
are you troll?

 

[Antonia]

thus I like: giving 'good advice'. what other tiny beasts
have entered inside from sasser?
when they violate your PC to you, to see if you will
continue giving to those advice note who you continue
being a useless one.

Courtesy of spanish MVPs:
From: "Antonio Amengual[MSMVP]" <[email protected]>
References: <[email protected]>
Subject: Re: [HOAX] Formatear despues de cojer el Sasser
Date: Tue, 4 May 2004 12:09:27 +0200
Message-ID: <#[email protected]>

asi me gusta dando "buenos consejos", que otros bichos han
entrado aparte
del sasser?
cuando te violen tu pc, a ver si sehuirás dando esos
consejos
se nota que sigues siendo un inutil

 

[Antonio Amengual[MSMVP]]

dedicate a fregar escaleras pa traductora no vales

 

[Vulpes]

¿pero..... no sabes quien es?... juas!

--
Vulpes vs Corvus
(e-mail address removed)

---------------------------
[Filtrado por bobo] <- KillFile para los horteras
Ille Corvus

[Filtrado por inculto] <- Troll con cero aportaciones
Maximilian Heel

 

[Antonio Amengual[MSMVP]]

si nuestro amigo accionista