LSA Shell Rebooting WinXP

[dullard]

A computer at work is rebooting on its own. But it doesn't reboot immediately. Instead there is a little box saying it will reboot in 30 seconds. Unfortunately I haven't been around at the right time to see what else the message box says. When the computer reboots, there is one of those Windows Error Reporting Windows that opens asking if we want to send the data to Microsoft. That last window says that LSA Shell crashed.

What is LSA Shell? How do we get it to stop rebooting the computer?

 

[DanTMWTMP]

i'm thinking it's that mblaster worm thing, or something similar.

http://www.securitybastion.com/BlasterRemoval.htm

 

[dullard]

Thanks for replying. It doesn't seem to have any of the symptoms of the Blaster virus. And it was almost fully up to date with firewall, McAfee, and Windows updates. I noticed there was one additional critical Windows update it needed and just installed it.

Any other ideas?

 

[pcmodem]

Yeah, I've got a laptop here too with the same problem, no idea.
-PCM

 

[DanTMWTMP]

http://www.securityfocus.com/bid/465/discussion/

These symptoms can be delayed by disabling the automatic debug option in the Registry. To disable this, set the "Auto" value of the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug key to "0". In this configuration, the debugger will prompt the user to continue. The symptoms of the attack will not appear until this dialog box has been cleared.

 

[Jgtdragon]

This might be the cause.

 

[GregANDTCH]

"Document Not Found"
Link might have session cookies?!

 

[earlj21]

Most likely the W32.Sasser.B.Worm.

Go look at the details at Symantec or McAfee. You also need to download the latest Microsoft updates.

McAfee also has a standalone cleaner that will remove the worm.

Good luck