HELP! got a virus!! lsass ???

[tichyuk]

my computer seems well f**ked up.

is it this
Win32/Lovgate.C@mm

how do i get rid of it?
my pc is going slow as hell and i have a shutdown, it gave me 60s ???

:bawling: :bawling: :bawling: :bawling:

[tichyuk]

i cant end lsass process or smss process :(

[BlackDiamondJr]

This sounds like the Sasser Worm.
It started spreading on Friday night.

http://news.com.com/2100-7349_3-5203764.html?tag=nefd.top

http://www.microsoft.com/security/incident/sasser.asp

[ReflectionDesigns]

Hope this helps ya:

lsass - lsass.exe - Process Information

Process File: lsass or lsass.exe
Process Name: Local Security Authority Service
Description: Windows Local Security Authority Server Process handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

[tichyuk]

its all gone now but my computer is still going slow,
im on broadband and now pages takes ages to load :bawling:

[Virgin San]

Nope this is an old virus not the sasser - removal tool from Symantec here (http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.lovgate.c@mm.html).

Edit - hmm, I see you've sorted it and still have probs - you done a full scan with latest defs and also used adaware or similar?

[tichyuk]

i had the sassar virus and another 2 and norton never detected them till the full scan was done, got knows how i got them, i never opened any emails

[BlackDiamondJr]

You don't have to do anything to be infected with the Sasser Worm. You just have to be connected to the Internet and not have the latest Windows Updates and a firewall.
The worm is similar to the Blaster worm, it exploits a hole in Microsoft's security. In this case it believe it enters through Port 139.

[tichyuk]

ok, i have got rid of all the virus's , done norton and all that.
but, when on the internet it take agaes to load each page, i tried to defrag and it says there were file corrupt.
BUT
my computer is not doing scan disk/chkdsk
as normal if you want to fix anything it will run on startup but its not, when i restart it just boots up as normal straight to the login screen, what can i do to get this to run except connect my hard disk to someone elses computer?

Cheers
Tichyuk

[BlackDiamondJr]

Assuming that you are running Windows XP, you might want to boot to the Recovery Console with the CD and run chkdsk /r at the prompt.

[tichyuk]

on the laptop now

also i know why things are sooooo slow, explorer.exe process is using ALL of the CPU
i noticed that the .exe after explorer is in capitals! explorer.EXE. its not like this on anyone elses computer??

lmk

[BlackDiamondJr]

If you are running Windows XP make sure that you are running Service Pack 1.
This sometimes occur with corrupted video files or when spyware/trojans are active on your system.
Have you done spyware, trojan, virus scans?

[tichyuk]

i have norton and spybot and ive ran them both,
i have ran on-line house call thing and it found one in downloaded program files, which i cant seem to find

[BlackDiamondJr]

I've seen this problem all over the Internet but I've yet to see anyone suggest a fix that addresses the problem for most cases. Some people have found relief through Registry modifications, some have found that removing malware from their system alleviates the promlem and some have suggested that the latest Service Pack has corrected the problem. Most people are still searching for answers and it appears that an Operating System reinstallation is their only option. Some have reformatted and still have the same problem so the problem is fairly widespread with no concrete solution.

Explorer.exe Process Uses Many CPU Cycles When Windows Is Idle (http://support.microsoft.com/default.aspx?scid=kb;en-us;317751&Product=winxp)

I can only recommend that you scan for malware and viruses with the latest update for each application. Run msconfig and disable all unnecessary startup items. A list with explanations can be found HERE (http://www.lafn.org/webconnect/mentor/startup/PENINDEX.HTM).
Make sure that you are running the latest Service Pack for your system.

[tichyuk]

that helped, i have loads of left overs from virus's acocording to that.
the svchost.exe i cant get rid of, ran the tools from the web and done the mannual one but when i got to end process it gives me 60s, and that process is on my new laptop2!!
aaaa, norton must be $hit!

[BlackDiamondJr]

svchost.exe is a legitimate Windows process and is required by several other processes. It should appear several times on the list of running processes. Typically it appears about four times but it could be more depending on what other processes are running.
svchoste.exe and svchostc.exe and similar entries are trojans. Do not confuse trojans and worms with virus as they are different. Norton's protection is primarily virus protection.

Sometimes it's more effective to remove stubborn pests in the safe mode after they have been indentified.

THIS (http://www.sysinfo.org/startuplist.php) site has the most extensive list for startup items but they often easily exceed their CGI quota and thus deny you access to the site. If that happens, and it will, you'll have to try it another time.

[tichyuk]

cheers mate, you have been a great help.
Everything being slow was sorted out when i uninstalled norton and now i have AVG.
PC is back to normal.

Thanks for all your help

[Virgin San]

Another one in the eye for Norton :splat2: