August 24th, 2004 07:07 PM
lsass.exe terminated unexpectedly
I use winXp pro and lately i have got a virus that pops up a message saying that
c:\windows\system32\lsass.exe terminated unexpectedly
Suhtting down in 1min
Did google on this but wasn't able to find anything concrete to delete this virus.
Does anyone know how to get rid of it?
August 24th, 2004 07:22 PM
Check out the Sasser family of viruses, sounds like your problem. Symantec has a removal tool.
August 24th, 2004 07:58 PM
if you need to prevent the system from shutting down while you remove/scan the virus, go to start/run/cmd to open your command prompt. type in shutdown -a and the system should stay up while you repair it. good luck.
\"Computer games don\'t affect kids; I mean if Pac-Man affected us as kids, we\'d all be running around in darkened rooms munching magic pills and listening to repetitive electronic music.\" Kristian Wilson, Nintendo, Inc. 1989
August 24th, 2004 10:30 PM
And be sure:
Follow the instructions given:
get the fixtool and d/l the ms patch
also If the fxsasser tool from Symantec says it is clear.. APPLY the MS Patch.. If you have problems installing the patch.. you will have to deal with a member of the Gaobot family..
IF nothing is found, and the patch is applied with out problem, and a av scann in safe mode is clear.. don't be suprised. The failure of the lsass service occures when the worm attempts to aattack your machine it dosen't mean the worm is in your machine.. the lsass vulenerability has the lowest rate of infection
Actualy while your at it.. do a full update with ms.. seems you have missed one or five critical updates..
"Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr
October 29th, 2004 02:19 AM
Make sure your firewall is on and working
October 29th, 2004 07:21 AM
In all due respect, this thread is a few months old.. if you see stuff blinking then don't reply to it [I realize it's your first post] Plus, who says he has a firewall?