What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

my computer is automaticaly shutdown problem

basically when i have connected my internet explorer or my outlook experss that time my computer is automatically shutdown the problem is sasser virus problem how to remove that virus tell me that solved problme

HI GUYZ,

OMG HELP!! LOL!!!!

Im an idiot, so save your breath, lol. I have found the last week to be very entretaining indeed. It all ocurred on the 18th of May. I got hit by sasser... Well, i didnt have a virus scaner and that is because i had just recently accured this computer from my mum (Dont laugh) and it was the first time i had connected to the internet from it. Bad timing i guess...

So your proabably wondering why im rambeling on and when im gona get to the point right? Well, after a tremendous and epic battle with 5 viruses on my computer i have not yet succeded in banishing these criters from my computer!! LOL, im having fun but i definately would like a bit of advice if there is any to be given.

The viruses i have after a week of fighting are:

Bobax.A
Ronoper.U

Im not sure if i still have the sasser virus, i happened to have had 2 different strains, both the Sasser.C and the Sasser.E. I have run symantecs "W32.Sasser.Worm Fix Tool" and it has not found them. I know i still have both Bobax.A and Ronoper.U viruses as i have instaled "AVG 6.0 Anti-Virus System" which does not run but it has a scan shell of somesort which warns me of the presence of these 2 viruses.

I cant instal the Mirosoft Security Update as i cannot run it. I cannot run registry ither. I have tried just about all avenues that i know of and have had no results.

So, any tips?

:-)

Domen

Jagadeesh: Please read the full article. http://ask-leo.com/archives/000114.html

Domen: well, have you followed all the steps in the article, including the firewall? That should help prevent further infections of this sort. Next, I'd keep hitting the symantec site and search for those specific viruses by name ... even when the scanner doesn't fix 'em, they almost always include manual "hot to remove" steps for each specific virus.

Good luck!

Right now, in addition to Sasser I also got something that seem even worse...it will kill most fixes that I am trying to apply to my XP Pro system! When I tried to install XP SP1, or Sassor fix, the pop-up dialog will get killed, so that I cannot apply the fix or SP1...some fixes goes through, but most will get kill...anyone know what to do to fix this? I upgraded from XP Home to XP Pro--didn't help...I re-install the MS installer, didn't help either..... PLEASE HELP.

Have you run virus and spyware checks? Do you have another machine you can use to get the latest virus signatures down? That'd be my approach ... try a couple of different anti-virus programs with the absolute latest signatures. Recommendations: http://recommend.pugetsoundsoftware.com . Given that you seem to have multiple problems, that seems the mostly effective bet.

there r a process "dirote.exe","dorod.exe" appear in my win2000 professional PC,I know it's the Troj virus and serach the website all,but still donnot know what's the effect way to clean the virus?is it only the "Sophos Anti-vius" can do so?i donnot use such software before,please gice me more advice,thanks more!!!

Sophos is certainly a fine package, though I don't know if it's the only one that can deal with this specific virus. Regardless, using SOME kind of anti-virus software is the right thing to do. If the Sophos web site has information on that specific virus, then I'd certainly suggest downloading and using their virus scanner. And then continue to scan regularly to avoid future infections.

Hey, if you're not trusting your own AV, there's always online scans, such as the one at Trend Micro (though you need to use IE for it... one of the few things I use it for instead of Mozilla.)

You may also (for future use) want to go to Microsoft's website and get their update CD - they shipped it to me, free of charge (along with Computer Associates' AV and firewall package, which I don't use - I'm happy with AVG Antivirus and Zonealarm.)

Good Luck...

tank you verry much for your help about sasser virus

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.