LSASS.exe

[Charisma]

Hi,
MY system was became shut down automaticaly and it
says "your system will be shut down after 55 seconds" and
writes a file name c:\winnt\lsass.exe
please help me all of my clients have this problem.
thank you.

 

[Laura E. Hunter \(MVP\)]

Sounds like the Blaster worm, which targets the lsass.exe process:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Be sure that your anti-virus definitions are fully updated, as well as all
Windows Critical Updates from windowsupdate.microsoft.com.

There could be a newer worm than Blaster that's targetting lsass.exe, but
these steps will get you started in the right direction.

 

[Peter van der Woude]

There could be a newer worm than Blaster that's targetting lsass.exe, but

these steps will get you started in the right direction.

Yep, this one probably:
http://vil.nai.com/vil/content/v_125007.htm

Peter

 

[Trafton]

Hi Charisma,

You are infected with W32/Sasser.worm.

The first step to take is to update your machine with the latest patches.
You can do this at the following site:

http://windowsupdate.microsoft.com/

Then, you need to remove the worm. This can be accomplished using McAfee's
Stinger program. Stinger can be downloaded here:

http://vil.nai.com/vil/stinger/

Hope this helps. Feel free to post back if you need any more assistance.

Sincerely,
Benjamin Johnstone-Anderson
Microsoft MVP - Windows Security
Remove "SPAM" from email address to reply!
Security Manifest: www.msmvps.com/trafton/

 

[Charisma]

Hi,I updated my windows but in microsoft word the name of
fonts was damaged and changed to garbaged character,we use
of Farsi fonts,fonts is so important for us,what can I do?
Please help me.
Thank you.

 

[Karl Levinson [x y] mvp]

The FIRST thing you need is anti-virus, and
make sure it is configured to download the latest updates at least once a
week. www.grisoft.com is free anti-virus, use it. [Note that once you are
infected, your anti-virus may not be able to remove some viruses, in which
case you have to download and run the www.mcafee.com "Stinger" tool or
search the virus encyclopedia on the web site of your anti-virus
manufacturer for the exact name of the virus found on your computer, in
order to download a special one-time virus removal tool.]

If you aren't running XP, you need to get your own firewall. www.kerio.com,
www.sygate.com and www.zonealarm.com are all free firewalls. Get one.

The LSASS vulnerability is fixed by the MS04-011 patch. You need all the
Microsoft patches, but pay special attention to that one. First, download
and install that patch by going to www.microsoft.com/technet/security and
reboot. Then, be sure to visit http://windowsupdate.microsoft.com about
once a month [preferably Wednesday after the second Tuesday of every month]
to get all the patches you need. The first time you visit there, you may
have to visit the site and reboot two or three times in a row to get all the
patches.