20 replies to this topic

[silent_signal]

Hi all
I have just been having really bad luck with computers at the moment. One of my computers keeps getting an error in the service LSASS.EXE and keeps rebooting when I turn the computer on. I have been reading up over the internet about this problem and they say that it has somthing to do with SP1 for Windows XP. The system that the error keeps coming on has Windows XP professional SP1 installed. I tried finding some fixes over the net but no luck so I thought I might try here. Anyone no anything about this or how to fix it preferably. Thanks alot guys.


silent_signal

[IGL]

thats a new virus.
download the latest virus signatures for you virus scanner.

then visit windowsupdate to fix the hole the virus comes through.

[silent_signal]

u sure its a new virus? I was reading that it wasent a new virus. Weird thing is when I go to update my virus definitions it gives an error half way through it and I try to get onto the symantec site and for som weird reason it keeps saying Page cannot be displayed. The other weird thing is I can access every other site I want to. Strange indeed.


silent_signal

[FlyByNite]

lsass.exe = Local Security Authority Service (WinXP system process).

Windows Local Security Authority Server Process (Microsoft Corp.) handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.

It is not a Virus, Trojan, Worm, Adware, or Spyware.

However, it (like many other .exe files) can become infected by a virus, worm, etc.

Edited by FlyByNite, 03 May 2004 - 05:16 AM.

[Jito463]

Actually, there is a known vulnerability in lsass.exe that was announced May 1st. There is also a virus/attack method that is strikingly similar to the RPC service attacks about a year ago. If your firewall is enabled in XP, you should be safe. There is an update from MS that fixes this flaw and has been available since April 13th.

[silent_signal]

yer it was Sessar virus. Its all gone now. Thanks for the help guys.


silent_signal

[IGL]

hehe, i only post if i am a 120% sure

[silent_signal]

Cheers champ. Yer that virus has now spread through all my school and at a uni up my way and even at my tafe. lol. The guy who thought this virus up is a genious. To bad he dident put his intellegence towards somthing useful and not as anoying.


silent_signal

[shawn_nee]

Just FYI from microsoft itself on this topic...

Microsoft teams have confirmed that the Sasser worm (W32.Sasser.A and its variants) is currently circulating on the Internet. Microsoft has verified that the worm exploits the Local Security Authority Subsystem Service (LSASS) issue that was addressed by the security update released on April 13 in conjunction with Microsoft Security Bulletin MS04-011.

An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.

I tried to post the graph but it didnt look correct Either way this is a WORM that doesnt require you to click to activate it. I have seen sites that state if you don't have a firewall your system once connected to the internet, will become infected within 10 minutes.

[Jito463]

That's correct, Shawn. It's just like the RPC bug from last year. Best defense against it (besides getting the update from MS) is to make sure you have a firewall. Even the built-in firewall in XP will stop it.

[silent_signal]

thats a bummer cause the systems I got the virus off they had no firewall and the windows XP firewall was disabled. Is that firewall in XP any good anyway compared to others like Norton Personal Firewal



silent_signal

[Jito463]

It's a very, very basic firewall. Barely a firewall at all really, since it only blocks inbound, not outbound traffic. However, it does work. And barring a better solution (like either a full-featured firewall or a router/hardware firewall), it does the job.

[silent_signal]

oh ok then. Well Norton Internet Security 2004 Pro seems to be going well for me. Sasser was still spreading through my school computers today lol. The admins are certainly taking there time with fixing the problems, but they say they will get to it eventually :no: .



silent_signal

[silent_signal]

P:S
Its my b/day to day. Im finaly 18.



silent_signal

[ShutDown]

happy birthday! have a great day!

[IGL]

happy birthday signal, just 2 weeks and it's my turn

[ShutDown]

whens your birthday IGL, mines in 2 weeks minus 1 day, 18th may.

[IGL]

lol, i said 2 weeks. that would be the 19th, right?

[silent_signal]

thanks guys


silent_signal

[ShutDown]

lol, i said 2 weeks. that would be the 19th, right?

sorry, i thought you meant during the week thats in 2 weeks. i didn't know u meant in exactly 2 weeks. anyway, i found out from your profile after i posted