Printable View
I use winXp pro and lately i have got a virus that pops up a message saying that
c:\windows\system32\lsass.exe terminated unexpectedly
Suhtting down in 1min
Did google on this but wasn't able to find anything concrete to delete this virus.
Does anyone know how to get rid of it?
Check out the Sasser family of viruses, sounds like your problem. Symantec has a removal tool.
Removal tool
Cheers:
if you need to prevent the system from shutting down while you remove/scan the virus, go to start/run/cmd to open your command prompt. type in shutdown -a and the system should stay up while you repair it. good luck.
And be sure:
Follow the instructions given:
get the fixtool and d/l the ms patch
also If the fxsasser tool from Symantec says it is clear.. APPLY the MS Patch.. If you have problems installing the patch.. you will have to deal with a member of the Gaobot family..
IF nothing is found, and the patch is applied with out problem, and a av scann in safe mode is clear.. don't be suprised. The failure of the lsass service occures when the worm attempts to aattack your machine it dosen't mean the worm is in your machine.. the lsass vulenerability has the lowest rate of infection
Actualy while your at it.. do a full update with ms.. seems you have missed one or five critical updates..
cheers
Make sure your firewall is on and working
In all due respect, this thread is a few months old.. if you see stuff blinking then don't reply to it [I realize it's your first post] Plus, who says he has a firewall?