LSA shell errors // Sasser Worm // Please help

[KornNut]

Sasser Worm opens security ports on the infected computer which makes it vulnerable to hackers who can use these open ports to implant Spyware and Trojan Programs.

There are two obvious symptons of the Sasser Worm:

* A fatal error pop up asking if you would like to send the report to microsoft or not.

* After a few minutes of computer use, a 60 second count down occurs saying that the computer will automatically shut down in the allotted time.

I have tried the following patches:

http://vil.nai.com/vil/stinger/ (McAfee)

http://support.microsoft.com/default.aspx?scid=kb;en-us;841720 (Microsoft)

Yet, the sasser worm is still there.

I have also tried running hte patches with out being connected to the internet and with system restore disabled.

Any suggestions?

 

[suker]

you must kill the virus and spyware at first!

scan your computer for virus and spyware then run the patches!

 

[intercodes]

KornNut,

The patches just patch the lsass vulnerablity. But your system is already infected and so, you need to remove all the virii .Any AV [ with updates] can get thro and kill sasser worm

Sign
codes

 

[KornNut]

Both the microsoft and McAfee claimed that they worked against 44 spyware viruses. Also, when the program accomplishes, they state that 'all such viruses have been removed from your computer'

 

[ShoobieRat]

The AV programs didn't find it then.

Have a look around www.pestpatrol.com

You'll most likely have to remove the associated spyware, then go dig through your registry and remove all the keys associated with it, manually.

Oh, and for the love of God...don't email anyone!

 

[intercodes]

KornNut,

I suggest you to look at the Miscrosoft site for removal of these sasser/msblast ..etc worms. They have excellent guides to remove these stuff.

goto http://www.microsoft.com and search for sasser removal.

sign
codes

 

[KornNut]

As I had said in my original post in this thread, I have tried microsofts online patch already.

As Shoobierat had said, the anti viruses have no worked.

The only other solution that I see is Service Pack two. The problem here is that it takes so long for this to download that the Sasser worm restarts the computer before the download is able to finish. It looks like that I may have to order the service pack on disc through microsoft.

However, I have noticed that the LSA error only occurs when the computer is connected to the internet.

 

[intercodes]

KornNut,

Follow the link and do exactly what it says....

http://www.pchell.com/virus/sasser.shtml


Sign
Codes

 

[KornNut]

thanks for the reponses


That last link seems to be extremely helpful, however, I wish I could put it to use. ..

This Sasser worm hasn't been occurring in my computer. It exists in my college roommate's computer (an old P3 733 MHz proccessor).

I have yet to get rid of the virus, but now the computer has a harddrive error. When it rains, it pours.

I'm just going to have to replace the harddrive and reinstall windows.

thanks again.

 

[sunsider]

one way to stop the worm from shutting you down in the 60 seconds is to disconnect the pc from the connection to the internet, install a basic firewall to stop its attempts, reconnect to the net and download the updates from microsoft. thats what worked for me.