lsass shuts down

[sk]

do someone know what to do if you get the message:
lsass.exe terminated unexpectedly with status code. The
system will now shut down and restart...i have installed
all sevice packs for w2k...but it still happend 1/2 minute
after i plug the network cable of my cable modem
connection..
thanks

 

[Andy Welcomer]

check for SASSER. That was one of it's symptoms.

 

[David H. Lipman]

Yes... ask in the following News Groups!

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Dave




| do someone know what to do if you get the message:
| lsass.exe terminated unexpectedly with status code. The
| system will now shut down and restart...i have installed
| all sevice packs for w2k...but it still happend 1/2 minute
| after i plug the network cable of my cable modem
| connection..
| thanks
|

 

[Steven]

Apply MS patch #040-011

It will correct the issue.

 

[Lanwench [MVP - Exchange]]

You've been infected by the Sasser worm. This means you didn't apply Windows
Updates (at least not very recently - patch for this came out April 13) and
don't have a firewall enabled....

For WinXP: If you can't stop your computer from restarting:

As soon as your computer reboots and Windows loads, click Start, then Run.
In the box, type the following:

shutdown -a (then click OK)

[for Win2k, shutdown.exe is part of the resource kit and the correct syntax
is
shutdown /a]

Then see http://www.microsoft.com/security/incident/sasser.asp and
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

McAfee's Stinger tool to remove Sasser: http://vil.nai.com/vil/stinger/

MS removal tool for Windows 2000 SP2 and up, or Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

Enable your XP firewall (or get a third party one if not on XP or even if
so - www.zonealarm.com has a free one) and run Windows Update regularly to
keep your OS patched to the gills. You also need good antivirus software and
need to keep it updated regularly. As mentioned, the patch for this exploit
was released April 13th...but there are plenty you do need. Perhaps want to
enable the autoupdate feature of Windows Update and subscribe to the
security bulletin announcements at www.microsoft.com/security.

 

[k.p]

Sassar worm has hit you. download the patch from
microsoft site

thanks

 

[Bruce Chambers]

Greetings --

No, applying the hotfix will _not_ "fix" the issue, it will only
prevent future occurrences.

Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[Bruce Chambers]

Greetings --

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next Shutdown countdown begins. This will abort the shut down. Also,
make sure you've enabled a firewall before starting, to preclude any
more intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH