lsass.exe

[Wolvie145]

Getting an error, followed by a countdown (About 40
seconds), followed by a complete computer restart.

The error: "C:\Windows\system32\lsass.exe terminated
unexpectantly with status code -1073741819"

It also says something about NT AUTHORITY\SYSTEM but I
missed that part. I can do it again and try to get the
whole thing if need be.

At restart I get another error message: "LSA SHELL
(Export Version) encountered a problem and needs to
close." Technical details of this error come back to a
that lsass.exe and another file appcompat.txt.

Virus scan came up negative. What to do next?

 

[Trafton]

Hi Wolvie,

You are infected with W32/Sasser.worm.

The first step to take is to update your machine with the latest patches.
You can do this at the following site:

http://windowsupdate.microsoft.com/

Then, you need to remove the worm. This can be accomplished using McAfee's
Stinger program. Stinger can be downloaded here:

http://vil.nai.com/vil/stinger/

Hope this helps. Feel free to post back if you need any more assistance.

Sincerely,
Benjamin Johnstone-Anderson
Microsoft MVP - Windows Security
Remove "SPAM" from email address to reply!
Security Manifest: www.msmvps.com/trafton/

 

[Guest]

the hard part is you can not stay on-line long enough to
download anything. eric

 

[Trafton]

Hi,

To avoid being disconnected, go to the START menu, and then RUN. Type
"shutdown -a" (without the quotes) and that will stop the shutdown process.

Hope that helps.

Sincerely,
Benjamin "Trafton" Johnstone-Anderson
Microsoft MVP - Windows Security
Remove "SPAM" from email address to reply!
Security Manifest: www.msmvps.com/trafton/

 

[Guest]

still powers down. ip says it may be gaobot virus.

 

[Lori]

I have been having the same problem. I have been trying
to download the patches and can only get 2 out of the 5
(KB831167 and KB837009). I get a message saying the
windows Logo is not valid or the Windows Certificates are
not valid.

To help the original poster:

Press Control/Alt/delete. Remove the malicious
processes. ie: aserver.exe (may have a number) and all
the processes with with a name of just digits followed by
_up.exe. Exit. Now go to start, run, type regedit,
click ok. Navigate to:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversi
on\run
In the right pane delete: "avserve.exe" ....
Exit the Registry Editor.

run your virus scan again.

From here I'm stuck. Can't get the new window updates,
and am receiving "Can't display Web page".

 

[Bruce Chambers]

Greetings --

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Guest]

-----Original Message-----
Getting an error, followed by a countdown (About 40
seconds), followed by a complete computer restart.

The error: "C:\Windows\system32\lsass.exe terminated
unexpectantly with status code -1073741819"

It also says something about NT AUTHORITY\SYSTEM but I
missed that part. I can do it again and try to get the
whole thing if need be.

At restart I get another error message: "LSA SHELL
(Export Version) encountered a problem and needs to
close." Technical details of this error come back to a
that lsass.exe and another file appcompat.txt.

Virus scan came up negative. What to do next?

I'm having the same problem, have you found any solutions?