lsass.exe problem

[David]

Lately i have been having a problem with lsass.exe, the
same application the sasser worm affects. The only thing
that i consider strange is that the error occurs only if i
sign on to Earthlink. As soon as i sign on my firewall
intercepts application: tftp.exe. After that Svchost.exe
is running like crazy and after a while lsass.exe has the
error and i get that annoying pop-up that says my PC will
shut down in 60 sec. Does anyone know what might be
causing this (i doubt it could be sasser) because if i
sign on to AOL it doesn't happen only if signed on to
Earthlink. This has started recently after using System
Restore; I am running XP Home With McAfee Virus Scan and
Firewall.

 

[Lanwench [MVP - Exchange]]

Lately i have been having a problem with lsass.exe, the
same application the sasser worm affects. The only thing
that i consider strange is that the error occurs only if i
sign on to Earthlink. As soon as i sign on my firewall
intercepts application: tftp.exe.

If you didn't install that, something else did - trojans are known to. It's
tiny ftp server, and if you didn't put it there, you don't want it there.
Run a full scan with Mcafee (update it first). Get a second opinion at
http://housecall.antivirus.com

After that Svchost.exe
is running like crazy and after a while lsass.exe has the
error and i get that annoying pop-up that says my PC will
shut down in 60 sec. Does anyone know what might be
causing this (i doubt it could be sasser)

Could be, or could be a variant. Did you install *all* critical updates
regularly? The patch for Sasser came out April 13th....but there are plenty
of other viruses that act similarly. I'd get the stinger tool from mcafee &
run it. http://vil.nai.com/vil/stinger/. If you can't stop your PC from

because if i
sign on to AOL it doesn't happen only if signed on to
Earthlink. This has started recently after using System
Restore; I am running XP Home With McAfee Virus Scan and
Firewall.

What made you do a system restore, and did you run Windows Update
afterwards?

Is your firewall set to deny *all* inbound traffic by default? It should be,
on a home system.