how to get rid of Window System 32\lsass.exe

[Randy]

I do not know exactly what happen here or how I got this but my pc keeps shutting down and error message says (window32\lsass.exe and will shutdown in 56 second and it does) repeatedly I am wondering if I can remove it or do I have to do a clean install of my operating system. I am using XP PRo platform. Alittle history on my pc. I using a P3 800 mh pci 100 128 ram. I attained more ram i think pci 133 128 ram I put it in my pc and it did not work so I took it out and my pc with only my original ram would not go pass to the desk top it kept freezing right before it would get to the desk top so I put my my WX pro cd and set it for repairing and I was able to get to the desk top but later that error message kept coming up and alot of my program was not working like office 2000 and It would not let me install it it kept freezing too. Anyway any suggestion is appreciated and have a happy 4th.

[ski]

What is the exact text of the error message?

[david eaton]

Most probably the Sasser worm. Try downloading the stinger, and runnning it.

To abort the shutdown, so you have time to do the scan, when the message first appears, go to Start> Run, and type cmd<enter> to get a command prompt.
At the command prompt, type shutdown -a followed by <enter>

After running Stinger, get an on line scan at either Housecall or Panda A/V, and let it fix anything it finds.

Finally, download http://www.merijn.org/files/hijackthis.zip
Copy it into its own folder, doubleclick HijackThis.exe, and hit "Scan and save log".

When the scan is finished, the log will open in Notepad. Do Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

[PrntRhd]

Randy,
I agree with David Eaton in that it is likely a worm infection, I also wanted to point out the file you quoted is a legitimate Windows file, so you cannot just delete it without breaking Windows. You have to remove the PC from any network or the Internet, boot into SAFE mode and scan for the infection.

Once removed, you must quickly get the PC protected with current AV definitions and firewall or it will re-infect the machine.

AVAST and AVG are free AVs if you need one, Kerio and Sygate and ZoneAlarm have free firewalls if you need one.

[Randy]

Thank you for the responses, I will follow this today. Can a memory stick carry this virus? My system never came close to a virus until I put that memory stick in and it did not work so I took it out and as you can see from my earlier post what happen. From reading up on this it does not affect win 98 pc but would it make the system stall or have mem problems. Thanks again

[david eaton]

A memory stick cannot harbour a virus. When powered down, the memory is completely blank. This is why a hard (cold) boot is recommended when cleaning viruses.trojans.

[Randy]

thanks again and happy 4th. I thought memory was volatile but the problem coincide with when I put the bad mem in my pc and the problem started almost immediately after I took that bad mem out. perhaps sometime after or during when I could not get my pc to boot properly and I used the xp cd and chose to repair where my OS was my Pc became vulnerable.

[PrntRhd]

Can a memory stick carry this virus?

Do you mean a thumb drive or pen drive? I have never heard of this happening with this worm before, but if scanned, it will probably come out clean. These worms are network aware worms spread on the Internet (the really, really Large network).