LSASS Problem

[AZNBoiOnFIYA]

ok, i did a full reinstall of windows and every time i log in, after a couple minutes theres this error message saying that LSASS (LSA Shell Export) program encountered a problem and now windows is shutting down. can anyone help me with this?

[Rastion Signe]

Sasser worm my friend, much like the blaster worm. At least thats what it was for me, update windows asap, and your problem should be solved. You can also download a removal tool from almost any major anti-virus company, I beleive microsoft has one too.

[AZNBoiOnFIYA]

thats the problem. every time i log in and i get to windows update, it encounters that problem and then shutsdown on me before i can update anything

[JezterVA]

For Windows 2000 and XP you can visit here for instructions on stopping the shutdown process and downloading the requisite updates.

http://www.microsoft.com/security/incident/sasser.asp

Cheers!!

[Kendan]

turn on a firewall before you connect to the net next time;)

[Moorsie]

I have read that the shutdown/restart is supposebly dependant on the computers clock. When it next says it is going to shut down, try changing the computer clock back and that may give you more time to download any removal tools. Hope this helps ...

[Kendan]

just quickly open up a console and type: shutdown /a

That will stop the shut down for you to be able to use the fix tool and turn on the firewall so you do not get it again.

[greenman100]

just quickly open up a console and type: shutdown /a

That will stop the shut down for you to be able to use the fix tool and turn on the firewall so you do not get it again.


or just a Run dialog box

apparently the OP isn't too familar with Google.

[Ian Cody]

opening up the task manager and ending the avserve.exe process should stop it from shutting down. than simply browse thru the registry to hkey_local_machine>Software>microsoft>windows>currentversion>run

and delete the "avserve.exe" key, after thats all done search for avserve.exe and delete it, also search for files with a 4-5 digit number than _up.exe (i.e. 1234_up) should get rid of it.

dont forget to update though!

[Rastion Signe]

yes! deleting avserve.exe WILL allow you to get on the net and fix your problem. Thats actually how I fixed my piece, I found avserve because I regulary check my task manager to see whats up, and I get used to certain names, avserve I did not recongnize so I deleted that stupid thing and viola! You will download it everytime you go on the net, but it cant run on the same boot you get infected by it. Basically I mean if you delete it and go on the net, it cant shut you down, but it will reinfect your sys, on the next boot if you go on the net it will shut you down. So get ridda that dumb thing and download your updates and you should be set to go, and in the future update frequently, believe me its not worth falling behind :)