My first virus! Now what?

Factual Questions
1

Ooh, now we have colored smilies back. Neat.

Anyway.

I’ve never gotten a virus. I’ve been online for 7 years and never had any problems. Well, maybe I got a virus, but it was never anything noticable. Due to this, I don’t know how to fix viruses, nor do I have any anti-virus stuff.

So, onto the problem.

I’ll get a little box telling me I have something like aminute to save things before my computer reboots itself. Here’s where it says the error comes from:

C:\WINDOWS\system32\lsass.exe
Error number 1073741819

My comp only crashes when I use it - if it sits idle for a few hours, it’s fine. When I’m using it, it crashes every hour or two.

So . . . what do I do now?

2

You may not have a virus at all, it may be a trojan.

http://www.annoyances.org/exec/forum/win2000/t1082093719

That should give you some ideas on whats happening and first hand stuff to try , for countermeasures.

Declan

3

Your best be is to go to http://housecall.trendmicro.com/housecall and run their online virus scanner. Set it to clean anything it finds. That should remove any viruses or trojans.

Don’t hunt down lsass.exe – it’s an essential operating file. If this is a virus problem, the virus is interfering with the process and that’s what has to be cleaned.

And get some antivirus on your machine. There is free antivirus at http://www.grisoft.com (AVG) and at http://www.free-av.com

4

I’m running Windows XP, and what I’ve seen online searching this, it won’t show up on a virus scan. It’s apparently not a virus. And I can’t find any way to fix it.

Now I’m peeved. At least I could fix a virus.

5

Did you go to http://windowsupdate.microsoft.com and applied all critical updates?

6

Process File: lsass or lsass.exe
Process Name: Local Security Authority Service
Description: Windows Local Security Authority Server Process handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;306497

It’s not a bug, it’s a feature.

7

It’s due to a version of Gaobot/Agobot that exploits a new Windows XP security hole. See http://www.sarc.com

Definitely go to http://windowsupdate.microsoft.com and install all critical updates.

8

I agree with the other posters. Make sure you download all available updates for your windows version.

On top of that, I’m guessing you don’t have any virus checking/removing software. I ran into a virus last week and didn’t have my regular laptop with me. After searching a bit thru various forums, I found Pandasoftware. It’s found viruses(viriii?) that the commercial software I use hadn’t(In defense of my commercial version, I hadn’t updated viruse definitions in a while). It’s free and you can find it by clicking on the ActiveScan logo on the mid-left of the page.

-K

9

Thanks, everyone!

I suppose seven years of not needing to know about viruses and updates have made me rather lax.

But, I did install the patch (Thanks, RealityChuck!), and I’ve been online for a while now with now crashing. I hope, hope, hope that this works. Not being able to be online for more than 10 minutes was starting to piss me off.

And, I’m DLing that Panda thing.

10

Panda has evaluation versions of its software, but I think like most shareware they time out. I purchased Panda AntiVirus Platinum a couple of years ago; the renewal fee is rather high, comparatively speaking, but you get daily virus definition updates. The last time I checked (and someone will no doubt be correcting me, since I haven’t checked in 2 years!), both Norton and McAfee only gave you weekly updates. It also includes a software firewall for incoming and outgoing access that’s pretty easy to configure.

Not affiliated, happy user, all the other caveats.

11

Panda isn’t free any more, but you can get AVG Antivirus, Antivir, or Bitdefender