XP upgrade

[scienceteacher]

My friend has an HP Pavilion that came with ME on it.
After fighting with ME for 3 1/2 years, I got her the XP
upgrade. Now her programs like MSWorks won't open. What
do I do? She's also getting a message that says her
computer is being shut down by NT AUTHORITY/SYS, and it
gives this info: C:\WINDOWS\SYSTEM32\lsass.exe and
references # 1073741819. What the heck does that mean?

 

[Carey Frisch [MVP]]

It appears the PC is infested with viruses.

How to Remove the "Sasser Worm" from your Computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]

Symantec Security Check
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

3 Steps to Help Insure Your PC is Protected:
http://www.microsoft.com/athome/security/protect/default.aspx

Frequently Asked Questions About Antivirus Software
http://www.microsoft.com/athome/security/protect/antivirus.mspx

Top 10 Reasons to Install Windows XP Service Pack 2 (SP2)
http://www.microsoft.com/windowsxp/sp2/topten.mspx

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

----------------------------------------------------------------------------------

:

| My friend has an HP Pavilion that came with ME on it.
| After fighting with ME for 3 1/2 years, I got her the XP
| upgrade. Now her programs like MSWorks won't open. What
| do I do? She's also getting a message that says her
| computer is being shut down by NT AUTHORITY/SYS, and it
| gives this info: C:\WINDOWS\SYSTEM32\lsass.exe and
| references # 1073741819. What the heck does that mean?

 

[Will Denny]

Hi

That error message means that the system has been infected by the Sasser
Worm:

http://www3.telus.net/dandemar/sasser.htm

 

[Al Smith]

My friend has an HP Pavilion that came with ME on it.

After fighting with ME for 3 1/2 years, I got her the XP
upgrade. Now her programs like MSWorks won't open. What
do I do? She's also getting a message that says her
computer is being shut down by NT AUTHORITY/SYS, and it
gives this info: C:\WINDOWS\SYSTEM32\lsass.exe and
references # 1073741819. What the heck does that mean?

You got your friend to upgrade to XP, but you didn't get her to
upgrade safely, and Windows XP is ten times less secure than
Windows ME. Now she's infected. Get her to download and run
Stinger from McAfee. That will probably clean off most of the
crud. Then spend some time looking into a firewall and antivirus
for her. Get her to do the whole Windows Update thing once her
firewall is running. Never do anything on the Internet without a
firewall running. This was not a big issue with Windows98 or
Windows ME, but a firewall is a necessity with Windows XP, because
it is so much less safe.

 

[Rock]

My friend has an HP Pavilion that came with ME on it.
After fighting with ME for 3 1/2 years, I got her the XP
upgrade. Now her programs like MSWorks won't open. What
do I do? She's also getting a message that says her
computer is being shut down by NT AUTHORITY/SYS, and it
gives this info: C:\WINDOWS\SYSTEM32\lsass.exe and
references # 1073741819. What the heck does that mean?

It means the computer accessed the internet without a firewall active
and without the OS being patched. It is a worm infection, most likely
Sasser.

 

[Bruce Chambers]

My friend has an HP Pavilion that came with ME on it.
After fighting with ME for 3 1/2 years, I got her the XP
upgrade. Now her programs like MSWorks won't open. What
do I do? She's also getting a message that says her
computer is being shut down by NT AUTHORITY/SYS, and it
gives this info: C:\WINDOWS\SYSTEM32\lsass.exe and
references # 1073741819. What the heck does that mean?

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next Shutdown countdown begins. This will abort the shut down. Also,
make sure you've enabled a firewall before starting, to preclude any
more intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/

As for the non-working applications, have you reinstalled them?
--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having
both at once. - RAH

 

[Guest]

no- I have her recovery disks but didn't know if it would
work now that XP is on the computer.