pc keeps rebooting

[Kim]

Hi
I join the web and within a minute i get a measage that
reads
The system process C:\WINDOWS\system32\lsass.exe
terminated unexpectedy with status code 1073741819
initiated by NT Authority\system.

The pc counts down from 59seconds and reboots. How can i
stop it from doing this.
PLEASE help.
Thank you.
Kim
xp pro

 

[kim]

Hi, thanks for your post but it is not a virus..My friend
took out my drive and put it in their pc with full upto
date norton...No viruses.
Yes i do bac up everything. learnt the hard way years ago.
Kim

 

[Guest]

Ah! Another unprotected computer, able to spread the infection to other
similarily unprotected computers.

 

[Rock]

Hi, thanks for your post but it is not a virus..My friend
took out my drive and put it in their pc with full upto
date norton...No viruses.
Yes i do bac up everything. learnt the hard way years ago.
Kim


I hope someone more


instructions, but it may be


you have been backing


reformat, you lose

Yes it is a virus -- mostly likely the sasser worm but also possibly the
blaster worm. Get off the net with it and do some research on how to
remove it. Take it to someone who knows what they are doing.

 

[NoNoBadDog!]

Despite what your friend says, You *DO* have a virus.

Lets see....



1. You connected to the internet without enabling the Windows firewall.



2. You also have no antivirus software installed.



3. You did not update your version of windows...if you had, the patch to

prevent infection from the SASSER or BLASTER worm would have been on your
system (it's

been available for months).



The reason that your machine is infected is because of all of the above.

You must educate yourself on basic computer security.



Here's what you need to do now, in this exact order...



1. Disconnect the computer from the internet...If you have broadband,

physically disconnect the cable from the back of the computer.





2. Turn the computer on. When the message appears, START>Run>'Shutdown -a"



3. Enable the windows firewall. It is very rudimentary as firewalls go,

but it is better than nothing.



4. Install a reputable Antivirus program. You will have to update it after

re-connecting to the internet, and thereafter you MUST KEEP IT UPDATED.



5. Connect to the internet.



6. Update your antivirus software.



7. Run a scan and let the antivirus software will clean your system.



8. Connect to Windows Update and download ALL Critical downloads. Install

them. You may have to repeat this more than once in order to download and

install all Critical Updates.



9. Never, ever connect to the internet, even briefly, without having met

all of the above requirements.



You not only allowed you machine to be infected, but you turned it into a

tool that is/was looking for other unprotected computers to connect. It has

been recently announced that an unprotected computer can be infected in as

little as 40 seconds.



I would venture a bet that your computer has more than just the latest

variant of the SASSER worm.



Once you begin to practice basic computer security, you can become a

responsible "netizen"



Bobby







Here are some useful links that were posted earlier by Bruce Chambers:





Protect Your PC

http://www.microsoft.com/security/protect/default.asp



Home Computer Security

http://www.cert.org/homeusers/HomeComputerSecurity/



List of Antivirus Software Vendors

http://support.microsoft.com/default.aspx?scid=kb;en-us;49500



Home PC Firewall Guide

http://www.firewallguide.com/



Scumware.com

http://www.scumware.com/

 

[Guest]

it is the SASSER WORM,,,,NOT a virus. You get it from not having an up to
date security patch on your IE browser..... when the counter starts, go to a
command prompt (start, run, cmd) and type in shutdown -a that will turn off
the counter but you still need to remove the worm. Check the mcafee or norton
sites or even MS for fixes for the sasser worm.
good luck,
L

 

[Guest]

Thank you for correcting me and saying it is a worm, not a virus. So what?
It's malware and he's got it.

 

[Malke]

Ah! Another unprotected computer, able to spread the infection to
other similarily unprotected computers.

You *do* have a virus - either the MSBlaster or the Sasser. Here is
information:

Sounds like you've gotten caught by the Sasser worm. To stop the
rebooting, go to Start>Run and type "shutdown -a" without the quotes.
For information about the worm, go here:

http://www.sarc.com/avcenter/venc/data/w32.sasser.worm.html

Get the worm off your system and then immediately patch XP:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx -
TechNet bulletin with download links
http://windowsupdate.microsoft.com

Install an antivirus program and keep it updated. Install a firewall. XP
has a built-in firewall, or there are free alternatives like Zone Alarm
or Sygate. Be aware that cleanup may be complex - we are now seeing
that infected computers usually have more than one variant of Sasser,
as well as one or more instance of a polybot worm from the
Gaobot/Agobot family.

And in case your infection has disabled any antivirus you may have had
(and you won't be able to install av on an infected machine):

1) Take the infected machine off the Internet and any lan immediately.
2) From a different, clean machine download Stinger
(http://vil.nai.com/vil/stinger/) and run it in Safe Mode. Stinger is a
limited virus checker, but its advantage is that it is standalone and
doesn't need to be installed.
3) Hope that Stinger cleans up the machine enough to be able to
reinstall your av or install a new, current one. Update its definitions
and do a full scan.
4) Continue the cleaning process by removing any spyware with Spybot
Search & Destroy (http://www.safer-networking.org) and Ad-aware
(http://www.lavasoftusa.com). These programs are free, so run them both
since they complement each other. You may also want to run CWShredder
and HijackThis from http://aumha.org/freeware.htm. Although CWShredder
is no longer being updated, it will still clean older variants of the
CoolWebSearch malware. Be sure to update these programs before running
them. Always read the instructions before running a spyware removal
tool. It is best to run antivirus and spyware removal tools in Safe
Mode.

Malke