Problem With Office Computer(Parents Need Help Fast!)

[TheMagicalJew]

First of all I will start out with the system specs

Some random HP Machine about 2-3 Years Old
around 2 ghz

192MB of ram

WinXpPro
Now, they use earthlink to transmit claims , etc etc, and medisoft(Claims Program)

Whent hey try to get on the internet after about 90 seconds they get a message that windows is going to automatically shut down in 60 seconds, and the error says something to do with LSA Shell
my mom says the error report had somthing to dow ith

szAppName.Isass.exe

thanks for your all help , its much appreciated

 

[bignasty]

apply service pack two... that should apply all the fixes you need to solve that, run an antivirus program and you should be fine, this is a virus and comes from not having updates installed or a virus scan...

Service Pack 2:
http://www.microsoft.com/technet/winxpsp2/

 

[BillLeeLee]

This is indicative of Sasser Worm (because of lsass being affected).

First, get the Sasser removal tool from here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

Now, hoping you or your parents have a fast connection. Download SP2 like bignasty says. If you download it on your computer, get the network install version and burn it to disc or save it to a thumb drive or whatever, and install it onto their comp.

And tell your parents to install a firewall and an AV (there are free ones like Avast and AVG) and to keep Windows updated.

 

[TheMagicalJew]

I ran the removal tool but it said it did not find the worm hmm, am i okay to plug it into my network at home or will it spread?

 

[dandragonrage]

It'll spread if you have unpatched/unprotected boxes only...

 

[D3v1an7]

The countdown to shutdown was Blaster, not Sasser.

Go here and download the removal tool.
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

and here to get the patch for the box
http://www.microsoft.com/security/incident/blast.mspx

after that, update the computers with windows update, get a anti-virus program and a firewall (either hardware or software)

 

[havenoclu]

Best thing to do is yes. Install SP2...then, I would run a few online virus scanners (these 2 tend to catch a lot that norton and mcafee do not)

http://housecall.trendmicro.com

and

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

PS. If you are running these and get the RPC shutdown issue while they are running, Goto Start -> Run and type "shutdown -a" (no quotes) .. this will abort the shutdown