Help Me Please, Shuts Down.

[Juan]

Hey guys, How is it doing, its me again...... The idiot with the volume Problem a while back. Well, I just got WinXP pro, and I am using Bellsouth DialUp. Everytime I connect to the NET, it shuts down my PC. Here is a PICTURE of it, hope someone can help me.


Please, I really need this out of my PC. Thanks all.

[Panama Red]

Looks like the Sasser virus. Here's the removal tool from Norton/Symantec. Download it with another PC and transfer the file to the ailing unit and run it.

http://securityresponse.symantec.com...oval.tool.html

[Mesaeus]

While the removal tool will come in handy to remove the worm on the hard disk, his problem is that lsass.exe gets corrupted by the malformed packet that contains the worm code. Windows notices this and then decides a 60 second countdown without any possibility to stop it would be fun.

First of all, you can stop such a countdown by clicking Start/Run... and typing "shutdown -a" . This will in fact abort the current shutdown. But the better idea is to enable the built in Windows XP firewall to prevent this from happening, otherwise this will happen as soon as you connect back to the internet. Download and install the patch for this vulnerability as soon as possible, you can find it here. Just removing the executable from your hard disk will not help until you enable the firewall and install the patch.

[Juan]

- That worm remover thing doesent find anything on my PC. I read everything, I did what it said, but it found nothing.

- Hey thankx, but I dont want to install nothing, because I installed SP2...... will that stop the auto shutdown thing?


Thankx for all your help.

[Mesaeus]

SP2 should include the correct patches to prevent the current worms from invading your pc, yes If you install SP2 you won't get the LSASS.exe error anymore. Make sure you keep your Windows as up to date as possible, there WILL be new worms in the future

Oh, and the auto shutdown thingy is because when windows notices that one of it's important services (lsass.exe) has crashed (because of the worm), then it will auto shutdown, this behavior is meant more for servers but all Windows XP versions do it (might be disabled in SP2). Like I said running "shutdown -a" will cancel any shutdown in progress.

[Juan]

omg man, thanks for all your help dude..... i dont know what I would of done. Without a JOKE, I have reformated my PC 12 times in the last 2 weeks. Thanks man.