XP prof. shutdown when I connect to the net...

[Guest]

I recently bought a copy of XP Prof. (I'm not sure what version exactly, but
I don't think its the newest one) and installed it onto my computer etc etc.
Everything works fine until I try to setup my internet connection (through BT
I might add). When I connect, after a minute or so I get a message saying
"the lsass.exe file has unexpectely shut down and the computer will restart
in 60 seconds" Then it shuts down (after 60 seconds!). This happens every
time I connect. I have enabled the XP firewall, and installed Norton
Antivirus, but nothing changes.

What can I do to prevent this from happening?

Thankyou
Calum

 

[Carey Frisch [MVP]]

It appears your PC is infected with the Sasser worm.

How to Remove the "Sasser Worm" from your Computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]

I would strongly recommend installing Service Pack 2
for Windows XP after removing the Sasser worm.

You may wish to view the following:

Top 10 Reasons to Install Windows XP Service Pack 2 (SP2)
http://www.microsoft.com/windowsxp/sp2/topten.mspx

List of fixes included in Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?scid=kb;en-us;811113&Product=windowsxpsp2

Learn About Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/preinstall.mspx

What to Know Before You Download and Install Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx

Windows XP Service Pack 2 (Direct Download):
http://www.microsoft.com/downloads/...be-3b8e-4f30-8245-9e368d3cdb5a&displaylang=en

Windows XP Service Pack 2 Checklist
http://www3.telus.net/dandemar/spackins.htm

[Courtesy of MS-MVP Jupiter Jones]

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

---------------------------------------------------------------------------------------

:

| I recently bought a copy of XP Prof. (I'm not sure what version exactly, but
| I don't think its the newest one) and installed it onto my computer etc etc.
| Everything works fine until I try to setup my internet connection (through BT
| I might add). When I connect, after a minute or so I get a message saying
| "the lsass.exe file has unexpectely shut down and the computer will restart
| in 60 seconds" Then it shuts down (after 60 seconds!). This happens every
| time I connect. I have enabled the XP firewall, and installed Norton
| Antivirus, but nothing changes.
|
| What can I do to prevent this from happening?
|
| Thankyou
| Calum

 

[Guest]

thanks for the advice, I'll try your recommendation this evening when I get
home...

 

[Bruce Chambers]

I recently bought a copy of XP Prof. (I'm not sure what version
exactly, but I don't think its the newest one) and installed it onto
my computer etc etc. Everything works fine until I try to setup my
internet connection (through BT I might add). When I connect, after
a minute or so I get a message saying "the lsass.exe file has
unexpectely shut down and the computer will restart in 60 seconds"
Then it shuts down (after 60 seconds!). This happens every time I
connect. I have enabled the XP firewall, and installed Norton
Antivirus, but nothing changes.

What can I do to prevent this from happening?

Thankyou
Calum

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next Shutdown countdown begins. This will abort the shut down. Also,
make sure you've enabled a firewall before starting, to preclude any
more intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having
both at once. - RAH

 

[Guest]

I tried the advice given last night - I installed the Service pack one, then
made sure the standard windows firewall was in place, and reconnected. I
also scanned my system with the clean-up tool suggested (it found no trace of
the virus)

Again, my computer started to shut down. I used the "shutdown -a" command,
which made the shutdown window disappear, but the system still shut dowm
after 60 seconds.

Nothing has changed. Maybe I'm doing something wrong...