lsass.exe

[Philip Coxon]

Hi,

Every time I connect to the internet I get an error message within a minute
or so of connecting and my laptop shuts down.

Message contains "C:\\windows\system32\lsass.exe" with an error code of
1073741819.

Any suggestions?

Phil.

 

[dev]

/Philip Coxon/ said:

Every time I connect to the internet I get an error message within a minute
or so of connecting and my laptop shuts down.

Message contains "C:\\windows\system32\lsass.exe" with an error code of
1073741819.

http://www.neuber.com/taskmanager/process/lsass.exe.html

 

[NoNoBadDog!]

You have connected to the internet without a firewall, you do not have any
antivirus programs installed, and you have not updated your version of
windows for a long time.

Your weak computer security practices have caused you to become infected
with the SASSER worm, and I would venture to say that your computer is
probably infested with many other viruses, worms, spyware etc.

To stop the computer from logging off, when the screen appears click on
Start>Run and type in "shutdown -a" (without the quotes). Then do a little
research into protecting and updating your computer. Until you take it upon
yourself to be a responsible netizen and install a firewall, a reputable
antivirus program that is kept UP TO DATE, and you regularly check windows
update and install all Critical updates, you are a threat (literally) to
everyone else. Your machine is now being used to spread the Sasser worm to
others like yourself who have not secured their computers.

Until you have learned how to be a responsible computer user, you should
not connect to the internet.

It is your responsibility to practice good computer security.

Bobby

 

[Philip Coxon]

I was looking for an answer; not a lecture.

This is a laptop that I bought recently due to the theft of my original. I
fully intend to install a firewall and anti-virus software, but as the
laptop only arrived this morning I have not yet had a chance to do so.

I hope that some day in the future I will feel so omnipotent that I can
deride and patronise someone for an innocent question, but until then I will
await an answer from a helpful person rather than a preacher.

Thanks for nothing.

 

[Bruce Chambers]

Greetings --

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next Shutdown countdown begins. This will abort the shut down. Also,
make sure you've enabled a firewall before starting, to preclude any
more intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[NoNoBadDog!]

Not patronizing at all...

there is no excuse for anyone to become infected with the Sasser worm,
Blaster, etc. I am finding more and more people that are either too
uneducated or too lazy to take even the simplest action to secure their
machines. It is because of them that Sasser and Blaster can continue to
spread long after the fixes are available. A lecture is indeed appropriate,
in hopes that it will shake someone out of their little rose-colored world
and make them be proactive.
The posting was not personalized for you. It was not meant to attack you
personally. Rather, it was meant to address anyone who does not take even
the simplest precautions. If the shoe fits, wear it. You should have
installed/activated a firewall before connecting to the internet. You did
not have an antivirus program running. That is why and how you became
infected.

I am not omnipotent, nor would I wish to be. I am just tired of the dozens
upon dozens of posts each day in the support groups of relating to this
worm. There is no reason why it should still be a problem, other than
laziness or ignorance on the part of the OPs.

I offer no apologies...your actions resulted in your machine getting
infected. It I had posted a quaint little reply replete with happy faces,
you would have probably continued on your merry way, unprotected and
unaware.

Bobby