"lsass.exe" and "Timed Shutdows"

[eXtremX]

Sometimes, when I connect to the Internet it appears a Shutdown warning with a timer, this warning as something to do with "lsass.exe", a process that I can find in the Processes window and is obviously running. Is this a virus or some kind of malicious code?

 

[bcastner]

Likely Sasser.

http://www.microsoft.com/security/incident/sasser.mspx

Be sure to download and apply the security hotfixes shown on this site to prevent the consequences of Sasser and Blaster.

You can stop the shutdown by immediately doing:
Start, Run, shutdown -a

Before using the internet again, enable the native ICF XP firewall.

http://support.microsoft.com/?kbid=283673

After removing Sasser, you might consider going to Service Pack 2. The following is a good checklist of preliminary steps before applying SP2:

http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx

 

[eXtremX]

I have here a Sasser removal tool and it indicates that there wasn't no infection found... Another thing: this happens generally on only one account of Windows.

 

[linney]

Make sure your installation is up to date with all Windows updates and Security Patches (or just install SP2).

Update your virus definitions and set it to scan for "all files".

Use some of the online scanners to double check your system.

What are Good Virus/Spyware?Update/Firewall Practices?
faq779-5240

Consider removing that one user and recreating another user profile. Or run this faq608-3482 on the profile and
rely on "Start, Run, shutdown -a " until the problem is fixed.

 

[bcastner]

Sasser has morphed several times. An out-of-date detection tool for Sasser is of little help. Run both the Trend Micro and Panda free online scans:

http://www.mvps.org/sramesh2k/Scanners.htm