lsass.exe Help!!

[dsmith2904]

Okay, since my tech guru is out of town, I'm appealing to anyone and everyone I can for help. Today when I turned on my computer a little shut down box popped up and part of the message said "system32/lsass.exe." When the computer restarted everything moved so slowly, it took like five minutes for Explorer to open. I've been on to the Symantec and Microsoft sites and did Yahoo! and Google searches to figure out what this thing is and still have no idea. We got the worm a couple of months ago so I am completely afraid to shut down my computer.

I did a Norton full system scan this morning and everything came out fine. Our system runs on Windows XP.

Thanks!!!

 

[Cleasai]

Hey there... I would just paste down what I found out, but it's a long response, so I'll just direct you to this link http://www.computing.net/security/wwwboard/forum/11294.html and ask that you read RESPONSE NUMBER 1. That should give you some insite on what to do.

PS... it does sound like a trojan

 

[dsmith2904]

That won' t cause any problems with the Norton Anti-Virus I already have?

 

[Cleasai]

Actually you know what? I just reread that article and it doesnt really have any solutions except for being able to identify the file. If you havent done it yet, hold off on it

 

[dsmith2904]

Also, I read a post further down that says this may be Sasser, which Symantec does have a patch for. Should I try that?

 

[dsmith2904]

Actually you know what? I just reread that article and it doesnt really have any solutions except for being able to identify the file. If you havent done it yet, hold off on it

I didn't do it yet because I noticed that same thing.

PS Thanks for your help.

 

[Cleasai]

Eh sorry, I'm not finding anyting. Guess you're gonna have to wait til Melon or Elvis comes around.

 

[KhanadaRhodes]

ooh, i know all about this. a lot of peeps @ somethingawful got this on their comp too. (someone there linked to a site with freeware that had lsass on it; it looked up their login info and sent it to the creators so they could steal accounts.)

usually most of the forums are private, but i can see if they're public right now. if not, i'll copy and paste the info people posted there to get rid of it.

 

[KhanadaRhodes]

hah, here you go. first post there linked to microsoft's website. let me know if this helps: http://www.microsoft.com/security/incident/sasser.asp

 

[dsmith2904]

I ended up taking the computer to Best Buy and they removed the virus without having to completely restore everything (thank goodness!!!). Why does all this computer stuff have to be so difficult and horrible? I wish bad things on people who create viruses.

 

[KhanadaRhodes]

i've now got it on my work comp. i have no idea how i got it, as i can't even go to websites at work. apparently it's coming through tcp/ip.

 

[melon]

If you all had been diligent in downloading all your patches from "Windows Update," none of this would have happened. The patch for the exploit that this virus takes advantage of has been around for eight weeks.

Also, if you run your internet through an internet router, they have a built-in firewall that deflects all these attacks. Something to look into, even if you aren't sharing your connection to need a router.

Melon

 

[Liesje]

Why does all this computer stuff have to be so difficult and horrible?

Start > Windows Update is all it takes.