lsass ended unexpectedly

[kmfna]

Hello all,

I recently installed XP Home on my friend's computer for her to use at college. When I set it up in my office, everything worked fine, no ethernet issues, no windows problems....however, when she plugged it into her network at school the computer will work for a minute or two and then a message from "NT/Authority" will pop up, state that lsass has ended unexpectedly and restart her computer in 60 seconds. If it isn't plugged in to the network it will not do this. Any ideas?? I thought it may be MSBlast, but I can find no instance of it on her computer. Could someone else have a worm that is killing vulnerable boxes on the network? I am planning to install Zone Alarm today and put SP 2 on her box, but if this doesn't work I'm not sure what else to do. Any ideas would be great.

Thanks in advance,
Kevin

- "The truth hurts, maybe not as much as jumping on a bicycle with no seat, but it hurts.

 

[StretchedTech]

It sounds like the Sasser worm. Norton has a good removal tool, then install the vulnerability patch as indicated at the MS site. It fixed our problem.

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

 

[linney]

Did you install and update a Virus Scanner for her?

 

[haslo]

it's a funny fact that when you have installed a Windows XP, are plugging it into the network and head for the windows update site with no firewall active, you'll have a multitude of worms (including Sasser) before you'll even have been able to download and install the necessary service packs. The worms take about 20 minutes on average...

haslo@haslo.ch - www.haslo.ch​

 

[micker377]

That's why I install Zone Alarm and Norton anti-virus in every system BEFORE I go on-line the first time. You can remove them later if you wish.

 

[dbMark]

Apparently you're safe behind a firewall? After you installed XP but before you let the computer out of your hands you should have installed all the available critical Windows updates. Then the Blaster (August 2003) and Sasser (April 2004) zapping issues would have been avoided.

Also, Microsoft has released a CD with all security updates through October 2003 (came out in February 2004) and just in the last few days you can start ordering the XP sp2 on CD too. Search here on this forum for the details and links if you can't find it on Microsoft's own site.

 

[micker377]

Oh yes, I install the "Security Update". I just used ZA and Norton to protect as much as possible BEFORE I go on-line, every little bit helps! Then I recommend the rest - AdAware, SpyBot, Spyware Blaster and Spyware Guard.

 

[kmfna]

hey,

Actually I put the latest version of AVG on the computer. And, actually, I am behind a firewall here, but she isn't at school. Either way, its cool, I'm getting the computer back and making sure to install everything, it was just an oversight not getting all of the critical updates. Either way It'll all be taken care of today.

thanks for all of your help.

Kevin

- "The truth hurts, maybe not as much as jumping on a bicycle with no seat, but it hurts.