Help!

13 Jul 2004 10:16 pm
karohemd: by LJ user gothindulgence (Default)
[personal profile] karohemd
Argh, I have of one of those things again that shut down WinXP after a while.
First, there's a message that "LSA Shell export version (windows\system32\lsass.exe)" has performed an illegal operation and will be shut down, and then a window pops up with a countdown.

The odd thing is that it only happens when I'm connected to the internet, the laptop runs fine on its own.

Update:
It's Sasser, updating my antivirus now (ONE day of it being out of date was enough).
Thanks to [livejournal.com profile] chrisvenus I know the command which stops the shutdown:
At a command prompt, type "shutdown -a"

Date: 13/7/04 09:19 pm (UTC)
From: [identity profile] aardnebby.livejournal.com
sounds like spyware/hijacking bots... you got up to date antivirus/antispyware stuff?

Try renaming the mentioned file/moving it.

If it gets worse, put it back, if not...

Date: 14/7/04 03:36 am (UTC)
From: [identity profile] deliberateblank.livejournal.com
If you muck around with lsass.exe (or csrss.exe, winlogon.exe or smss.exe) you can pretty much guarantee the situation will get very much worse very rapidly!

Date: 13/7/04 09:24 pm (UTC)
From: [identity profile] susanofstohelit.livejournal.com
You've got Sasser. http://forums.thetechguys.com/showthread.php?t=5630

what he said. download and run spybot (http://www.safer-networking.org/en/index.html) and see what all it picks up. then download and install AVG http://www.grisoft.com/us/us_index.php. update both of them (they have automatic updaters included) from the internet and run them again. that ought to get rid of it.

Date: 13/7/04 09:38 pm (UTC)
From: [identity profile] karohemd.livejournal.com
I'm checking for spyware and update AVG regularly, just not every day.
I updated AVG on Thursday before I left and get hit on the Friday, wonderful.

Thanks to [livejournal.com profile] chrisvenus I know the command which stops the shutdown:
At a command prompt, type "shutdown -a"

Date: 13/7/04 09:58 pm (UTC)
From: [identity profile] susanofstohelit.livejournal.com
a good trick when you get a message like that is to google what you've got. I found it by googling the file string/name.

Date: 13/7/04 10:08 pm (UTC)
From: [identity profile] karohemd.livejournal.com
That's what I tried but the shutdown happened about a minute after I had logged on.
Tonight, first thing was to post to LJ and second to log onto IRC and I just managed in time.

June 2025

M T W T F S S
      1
2345678
9101112131415
16171819202122
23242526272829
30      

Tags

Style Credit

Expand Cut Tags

No cut tags
Page generated 23 Mar 2026 07:27 am
Powered by Dreamwidth Studios