Lsass32.exe

[Iphis]

Hi guys

Having trouble with a worm called Lsass32.exe it doesnt seem to be responding to the normal removal tool or the patch that windows produced.
Basically the trouble with this worm is not that it keeps crashing i get a msg every two seconds saying lsass32.exe has encoutered a problem and needs to close etc

really bugging me been hampered by loads of probs l8ly any help on how to get rid of this infernal thing would be most appreciated

 

[Sycho]

Best thing to do is find out where the file is, then restart windows in safe mode(usually by hitting delete key at start up) then can delete it from there, reboot and let it start up normally, then it's gone.

 

[Elewyth(TLSOA)]

sounds dumb but have u tried deleting the file? lol yeah i know sounds silly.. but i had a rouge file like that once.. deleted it and was fine ever since.

 

[rivan]

Try this and this and it should be sorted.

 

[Iphis]

Thx for replies ive just traced the thing down and removed it in safe mode and altho the thing still there poping up in the processes of task manager it doesnt seem to be bothering me so not gunna rock the boat

cant believe i over looked something as simple as deleting it so appreciate u giving me a reality check as for the tool and patch thing erm it says i dont have sasser and patch is alrdy installed but thx for your input.

Thought i would reply and let u know things seem alot better thx for your time

 

[Elewyth(TLSOA)]

Thx for replies ive just traced the thing down and removed it in safe mode and altho the thing still there poping up in the processes of task manager it doesnt seem to be bothering me so not gunna rock the boat

cant believe i over looked something as simple as deleting it so appreciate u giving me a reality check as for the tool and patch thing erm it says i dont have sasser and patch is alrdy installed but thx for your input.

Thought i would reply and let u know things seem alot better thx for your time

another tip is type Avert Stinger into your google and download it. it searches for the worms and trojans specifically and removes them for you.

 

[Noheals-WR]

I had a problem with this one too...

Take off your auto-matic system restore in XP...the roll-back thingy before you run the sasser removal tool in safe mode.

I'm sure this b'stard stays resident in the system roll-back files and re-emerges everytime you boot if the restore was on when you removed it.

See if that helps.

 

[Thorwyn]

http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.ar.html

 

[Gorryk]

lssass32.exe is usually part of The Agobot/Gaobot/Randex trojan, and does let a remote user control your computer through irc (your compouter silently connects to an irc server without you knowing and recieves instructions). Whilst it is likely that this infection is unrelated to DaoC, it is feasible that someone has infected you in order to steal your game passwords, so I would change them ASAP just to be on the safe side.

Aslo, if you notice lsass.exe in your processes that is fine. It is an integral part of windows. lasass32.exe is the trojan related file and should be safe to delete.

 

[Iphis]

Ive now turned up the system restore and gunna remove will change my passwords as a precaution

thx for the posts really was getting frustrated with the damn thing