Thank you, David.  An earlier post made it appear that Isass.exe was part of the Sasser Worm, as did the website that was trying to sell a solution.          Ann Fennell

----- Original Message ----- 
From: David Gillett 
To: [log in to unmask] 
Sent: Sunday, August 22, 2004 9:46 PM
Subject: Re: [PCSOFT] Sasser Worm?


  LSASS.EXE is a standard component of NT/2K/XP, and is supposed to be
running all the time.  There are a couple of things that can make it crash --
 the Sasser virus is the most common.

David Gillett


On 22 Aug 2004 at 11:55, Paul J. Traynor wrote:

> Hi,
>
> I'll bet if you look under the hood so to speak by using something like
> task manager or a third party utility for showing up processes running
> you might just see something in that list called "lsass.exe" which might
> point to the culprit.
>
> Paul.
>
>
> -----Original Message-----
> From: PCSOFT - Personal Computer software discussion list
> [mailto:[log in to unmask]] On Behalf Of Tom Mayer
> Sent: 20 August 2004 17:06
> To: [log in to unmask]
> Subject: Re: [PCSOFT] Sasser Worm?
>
>
> Here is some information that might help:
>
> http://www.onlinepcfix.com/virushelp/sasser.htm
>
> Tom Mayer
>
>
>
> I have been trying to help a retired fellow with his computer woes.  His
> machine runs fine until he logs onto his ISP, then it will shut down
> within minutes.  The error message has to do with lsass.exe, and the
> windows displayed conform exactly to those with a Sasser worm problem.
> Yet, we can find no worm!  Symantec's tool to remove the worm finds none
> existing.  A Norton's AV scan says his machine is clean.  None of
> Microsoft's list of processes that are indicative of the worm are
> running on his machine.
>
> Any tips?  Could this be other than a Sasser Worm?
>
> Thanks for any help.
>
> Gordon
>
>                          PCSOFT's List Owner's:
>                       Bob Wright<[log in to unmask]>
>                        Drew Dunn<[log in to unmask]>
>
>       "Hold No Punches.." Rode brings you great shareware/freeware
>         programs with his honest opinions in this weekly column.
>                        http://freepctech.com/rode

      "Hold No Punches.." Rode brings you great shareware/freeware
        programs with his honest opinions in this weekly column.
                       http://freepctech.com/rode

             Do you want to signoff PCSOFT or just change to
                    Digest mode - visit our web site:
                   http://freepctech.com/pcsoft.shtml