LSA shell

[JM]

Ok....here's a recap of my current problem for all you WIN XP veterans:

1. I just set up my computer after moving. I am running WIN XP Home on a
Dell system.

2. I made several changes after the initial startup. I changed my modem
dialer to my new access number, installed and started to use a wireless
mouse, and connected my printers and CD writer. The printers and CD writer
were connected and in use at my old address with no problems.

3. I connected to the Microsoft web site to get any updates for XP. The
website prompted my to download a new version of their update program.

4. Shortly afterward (and I think the Microsoft download is the cause of my
problems) I began to get a system shutdown initiated by NT authority\system.
The shutdown message also says that c:\\windows\system32\lsass.exe was
terminated unexpectedly. Status code 1073741819.

5. I also downloaded a ran a PC debugger which continues to detail and
correct errors after each reboot....all the errors appear to be in corrupt
and missing shortcuts.

5. The last error report send to Microsoft had something about a problem
with LSAshell. But my system shutdown before I could click on the link about
further details.

6. I also can't download any XP updates (just takes too long before I get
that shutdown message).

Any ideas on how I can fix this problem?

Thank you in advance and please post any replies to this newsgroup.

 

[Carey Frisch [MVP]]

It appears your PC is infected with the Sasser worm.

How to Remove the "Sasser Worm" from your Computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]

I would strongly recommend installing Service Pack 2
for Windows XP after removing the Sasser worm.

You may wish to view the following:

Top 10 Reasons to Install Windows XP Service Pack 2 (SP2)
http://www.microsoft.com/windowsxp/sp2/topten.mspx

List of fixes included in Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?scid=kb;en-us;811113&Product=windowsxpsp2

Learn About Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/preinstall.mspx

What to Know Before You Download and Install Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx

Windows XP Service Pack 2 (Direct Download):
http://www.microsoft.com/downloads/...be-3b8e-4f30-8245-9e368d3cdb5a&displaylang=en

Windows XP Service Pack 2 Checklist
http://www3.telus.net/dandemar/spackins.htm

[Courtesy of MS-MVP Jupiter Jones]

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

-------------------------------------------------------------------------------------

:

| Ok....here's a recap of my current problem for all you WIN XP veterans:
|
| 1. I just set up my computer after moving. I am running WIN XP Home on a
| Dell system.
|
| 2. I made several changes after the initial startup. I changed my modem
| dialer to my new access number, installed and started to use a wireless
| mouse, and connected my printers and CD writer. The printers and CD writer
| were connected and in use at my old address with no problems.
|
| 3. I connected to the Microsoft web site to get any updates for XP. The
| website prompted my to download a new version of their update program.
|
| 4. Shortly afterward (and I think the Microsoft download is the cause of my
| problems) I began to get a system shutdown initiated by NT authority\system.
| The shutdown message also says that c:\\windows\system32\lsass.exe was
| terminated unexpectedly. Status code 1073741819.
|
| 5. I also downloaded a ran a PC debugger which continues to detail and
| correct errors after each reboot....all the errors appear to be in corrupt
| and missing shortcuts.
|
| 5. The last error report send to Microsoft had something about a problem
| with LSAshell. But my system shutdown before I could click on the link about
| further details.
|
| 6. I also can't download any XP updates (just takes too long before I get
| that shutdown message).
|
| Any ideas on how I can fix this problem?
|
| Thank you in advance and please post any replies to this newsgroup.

 

[Bruce Chambers]

4. Shortly afterward (and I think the Microsoft download is the
cause
of my problems) I began to get a system shutdown initiated by NT
authority\system. The shutdown message also says that
c:\\windows\system32\lsass.exe was terminated unexpectedly. Status
code 1073741819.

Any ideas on how I can fix this problem?

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed after a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next Shutdown countdown begins. This will abort the shut down. Also,
make sure you've enabled a firewall before starting, to preclude any
more intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having
both at once. - RAH

 

[Peter Hutchison]

Ok....here's a recap of my current problem for all you WIN XP veterans:

1. I just set up my computer after moving. I am running WIN XP Home on a
Dell system.

2. I made several changes after the initial startup. I changed my modem
dialer to my new access number, installed and started to use a wireless
mouse, and connected my printers and CD writer. The printers and CD writer
were connected and in use at my old address with no problems.

3. I connected to the Microsoft web site to get any updates for XP. The
website prompted my to download a new version of their update program.

4. Shortly afterward (and I think the Microsoft download is the cause of my
problems) I began to get a system shutdown initiated by NT authority\system.
The shutdown message also says that c:\\windows\system32\lsass.exe was
terminated unexpectedly. Status code 1073741819.

5. I also downloaded a ran a PC debugger which continues to detail and
correct errors after each reboot....all the errors appear to be in corrupt
and missing shortcuts.

5. The last error report send to Microsoft had something about a problem
with LSAshell. But my system shutdown before I could click on the link about
further details.

6. I also can't download any XP updates (just takes too long before I get
that shutdown message).

Any ideas on how I can fix this problem?

Thank you in advance and please post any replies to this newsgroup.

You have been infected with Sasser worm, reinstall Sasser patch again
and run Antivirus software to remove any infections.

Peter Hutchison