Virus alert LSA Shell

Please help me fast I don't know how to remove this:

My comp says that it's something wrong with this program:

LSA Shell (Export Version)

And it's located here

WINDOWS\System32\Isass.exe


But NOD32 does not seem to find the problem help me.

The prob is evertime I start my Internet some screen shows up and says it going to restart in ca 50 sec

Help me!!

 

Make sure you have all security updates from www.windowsupdate.com. If you have Windows XP (or Windows 2000?) enable automatic updates.

Best regards,
Anders

 

U can download manual this patch:
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx and read Microsoft alert http://www.microsoft.com/security/incident/sasser.asp

izi

 

Oy all- I have it too, but remember: what happens is that the timer starts once you log on to the internet. In 50 seconds you're done, period, so there is no hope of downloading a patch or update. I'm sending this post from work, since logging on from my home computer is a no-go. Additionally, I have a new message that "me (or my computer) is attempting to access <insert seemingly random address here>"

I wrote down a few...

186.221.165.51

or

57.152.132.85

but I'm too chicken to go there to see what's in store for me. I dunno

 

Click on "To see what data this error report contains", then click on "to view technical information about the error report. You should see the error file or files

eg:

C:\DOCUME~1\user1\LOCALS~1\Temp\WER1.tmp.dir00\lsass.exe.mdmp
C:\DOCUME~1\user1\LOCALS~1\Temp\WER1.tmp.dir00\appcompat.txt

Start a DOS windows, cd to that location:
C:\Documents and Settings\user1\Local Settings\Temp\WER1.tmp.dir00>dir
Volume in drive C has no label.
Volume Serial Number is 90EE-A830

Directory of C:\Documents and Settings\user1\Local Settings\Temp\WER1.tmp
.dir00

05/08/2004 07:44 AM <DIR> .
05/08/2004 07:44 AM <DIR> ..
05/08/2004 07:44 AM 16,486 appcompat.txt
05/05/2004 09:29 PM 4,279,898 lsass.exe.hdmp
05/05/2004 09:29 PM 235,502 lsass.exe.mdmp
05/08/2004 07:44 AM 1,754 manifest.txt
4 File(s) 4,533,640 bytes
2 Dir(s) 1,017,528,320 bytes free

Then, remove the file(s) that have errors

Dean.

 

Hi Covert!

When this window pop-up with shutdown: in command promt write 'shutdown -a'.

izi

 

btw
this is from Sygate logfile

is it from Sasser worm atteck ?
i sometimes get these every 10 min

Somebody is scanning your computer.
Your computer's TCP ports:
2745, 1025, 445, 3127 and 6129 have been scanned from 217.132.199.245.

 

As noted above, you most likely are infected with the Sasser worm and your computer needs to be disinfected. A PC is vulnerable to this infection if the latest MS critical update security patches have not been installed and the PC is not firewalled from the internet. If your using XP at least activate the XP firewall.

See this thread for more info a ways down on the thread: https://www.wilderssecurity.com/showthread.php?t=29140

Here's a link to McAfee's Stinger utility that removes many common worms/viruses. (Edited to add: looks like Stinger's been updated again so I imagine it covers the current Sasser variants.) http://vil.nai.com/vil/stinger/

 

Hey.. if you are in the middle of downloading a patch or doing something to get rid of this stupid "thing", all you have to do to stop the shutdown countdown is this...

Go to Start and click Run
Type in SHUTDOWN -A

that will stop the shutdown and u can proceed.

 

You got the same problem? Mine started 3 days ago. Fully patched WinXP+SP1 system with latest NOD32 (also latest updates) and i get Lsass RPC error,very similar to one which pops up due to Sasser. Formated whole disk and reinstalled everything and again i got this. It doesn't matter if i connect to net or not,i get this. I also use McAfee Personal Firewall 5 Plus,but i think this is not the problem. I'll post second error picture on next post since each is limited to only one attachement...

 

I found that this Event (found in Event Log under Application) is related according to the upper thing...

I'm 390% that this is not a Sasser that i know...
System was scanned with KAV,avast!,avast! Virus Cleaner,HouseCall and NOD32 at highest settings and nothing found. Need help!

 

Ok found another Event Log entry related to NOD32. Looks like IMON confilcts with something

 

Ok i got it. Its no worm. Its IMON. I uninstalled NOD32 and in instaled it again without IMON and system works fine. Such error just don't fall from the sky and i think it might be serious. I was testing my system for 3 days and on second day i got that NOD32 couses this. After that i reformated machine and reinstalled. Same s**t. Today i found that third log entry and according to it i disabled IMON and it works now. ESET programmers should take a look around this...

 

Anyone? I cannot use email clients because email is not scanned (IMON has to be fully disabled if i don't want to see that LSASS RPC error). I can use webmail instead for this time which is protected by AMON,but i hope for some help from ESET team.

 

If the lsass issue perists even with the latest version of NOD32 available on our website installed (2.000.9), please email support@nod32.com for the latest version of imon which has the problem eventually solved.

 

Or you can check here (at the end of topic):
https://www.wilderssecurity.com/showthread.php?t=35206

The imon.dll was submited by ESET support so its perfectly safe.
Hope its ok to you Marcos?

 

There's been several newer versions of imon made since. You might have a version which has not the problem completely remedied.

 

Ok what now? Has it been fixed? Can i download fixed (Commercial) version or do i still have to ask support to send me those fix files?

 

I would suggest still asking support, I have only come across 1 in 400+ PC's with this problem. Eset support will be able to email you or give you a link for a newer version of IMON/Nod32.

Cheers