LSA Shell (Export Version)

[Cranfield]

I keep getting a Firewall Message that a remote unit is trying to contact LSA Shell (Export Version).

The Norton Firewall recommends permitting this acess as "low risk".

Whats this all about ?

[Newt]

You are infected. The 'call home' thru the firewall is low risk. But .....

 

If you are running NT4/2K/XP/2003 then shame on you for not keeping your security patches up to date. If you are not running one of these operating systems you can't be hit by Sasser so ...

 

http://www.experts-exchange.com/Security/W...Q_20975585.html

[Cranfield]

I am running XP, with automatic daily updates.

Norton Anti Virus and Firewall installed, enabled and updated.

Nothing showing with a Norton virus scan, or AdAware (especially since I installed Spyblaster).

 

Do I have to pay those people to find out how to get rid of it (if I have it)?

[Cranfield]

Is it possible that I am not infected ?

 

Having looked at a few websites about this "worm", the main symptom seems to be that computers suddenly have to shut down.

This hasn't happened to me.

I can't find anybody posting on the Techie Forums that they have had the same message as me.

It also hasn't happened again.

 

Anybody have any ideas ?

[Newt]

Just looked at your original post and I mis-read the first time thru. That sounds more like a probe from someone who is infected.

 

Take a look Here for information and mainly make sure you have the MS04-011 patch installed. That should make you invisible to Sasser. If you set to be able to uninstall you should see it in Windows as KB835732.

[Cranfield]

Thanks Newt, on that site there is a facility to check if your PC is infected with the Sasser Worm, I tried it and mine came back OK.

 

What confused me, is that LSA Shell is a Microsoft security sytem on the PC.

I'm also suprised that Norton Firewall recommended allowing the contact.

[Peter Sharpe]

Thanks Newt, on that site there is a facility to check if your PC is infected with the Sasser Worm, I tried it and mine came back OK.

 

What confused me, is that LSA Shell is a Microsoft security sytem on the PC.

I'm also suprised that Norton Firewall recommended allowing the contact.

That link is blank! I would like to know what it was because I am also getting that message flagged up by Zone Alarm.

 

I have now found that I am unable to access the system information on my computer and system restore has frozen at about 75% of the way through on several different restore points. I was even unable to scan the computer with AVG for a while, but after continually running in updates it is now working again, but hasn't found anything yet.

Edited October 22, 2007 by Peter Sharpe