Isass.exe

[mambonuts]

I have this buried somewhere in my system, and can't get rid of it.

The system will shut down in 60 seconds at any time while I'm on the Internet...and reboot.

There is another window which pops up saying about the LSA Shell (Export Version) having a problem...

You probably recognize all this already...

I have tried a Virus Removal program, The stinger removal tool from Symantec, and the Sasser Worm removal tool from Symantec...but still the computer does the shutdown...and all these programs state that there is no virus on my computer.

Also, I've noticed som files in my directories have duplicates with the number 1 next to them...what is this from...?




I have to fix this problem...can anyone give me a solid answer?

Can I go into a folder directly and delete some files?

Or do I have to do a full disk format and start from scratch...

Thanks in advance...

 

[mambonuts]

If I remember correctly, it says the virus is in the:

Windows\windows32\system\isass.exe

I think this is right...if not...I'll post when it happens again...

 

[mambonuts]

Corrected:

D:\Windows\system32\Isass.exe

And it says...

terminated unexpectadly with status code 107374819

 

[dawnrayd]

You have the sasser worm mate.

Go to

http://www.nethomehelp.co.uk,

on the left hand side you'll see a link 'Sasser Removal', in the quick links section. Click on that, and it will show you an example of the shutdown message you're experiencing, plus details on the Sasser worm and it's removal.

When the 60 second timer comes up by the way, you can abort it but clicking on start, then run, and typing 'shutdown -a'.

Ed.

 

[dawnrayd]

Sorry I've just noticed that you said you've already run the Sasser worm removal tool from symantec. Try going to

http://www.microsoft.com,

clicking on 'more downloads' at the botton of 'popular downloads' on the right, and the 4th one down is a tool that searches and removes variants A-F of the sasser worm. Unusual if it doesn't detect anything, as the symptons you are describing is 100 percent Sasser.

 

[mlichstein]

By the way, it's Lsass.exe...Local Security Authority.

 

[gpalmer711]

Follow the instructions in "What are Good Virus/Spyware?Update/Firewall Practices?" faq779-5240

Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk

 

[mambonuts]

I followed the reply from Dawnrayd and that tool didn't detect anything either...

Maybe I should just re-format the whole drive to get rid of this...?

 

[gpalmer711]

There are other Worms out there that cause similar problems, run the Trend Micro and Panda scans in FAQ779-5240

Also make sure you have the latest updates from

http://windowsupdate.microsoft.com

Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk