Sasser (LSASS.exe Error) and Gaobot (Agobot) Worm Removal

A security issue has been identified that is affecting computers running Microsoft® Windows®, NT® 4.0, 2000, XP and Server™ 2003 software. We are aware that this issue impacts your ability to connect to the Internet, however, this problem is a Microsoft issue and is not caused by SBC Internet Services. You should contact Microsoft for help at Microsoft.com or 1-866-PC-SAFETY. Support of Microsoft Software (or any third party software) is outside the scope of support for SBC Internet Services, but SBC Internet Services is providing the following troubleshooting in an effort to assist our members. SBC Internet Services is not responsible for any negative impacts associated with this proposed troubleshooting.

I. Stop the shut down/reboot process

If your computer displays an LSASS error

and/or shuts down repeatedly, follow these steps.

1. In the Start menu, select Run…
   
   
2. Type one of the following commands based on your operating system.

Your operating system	Type this command
Windows XP	shutdown -a
Windows 2000 or NT 4.0	shutdown/L /A

3. Press Enter.

II. Identify, remove, and prevent the Sasser or Gaobot (Agobot) worms

• Sasser: Using Internet Explorer or the SBC Yahoo! Browser, complete the steps in this Microsoft Security article. The Microsoft Security article provides the critical Microsoft Windows update to prevent the Sasser worm and protect your computer, as well as steps to automatically identify and remove the Sasser worm. (Alternately, if you choose to use a different browser, you can download and run the McAfee Stinger virus removal tool.)
• Gaobot/Agobot: Download and run the removal tool at Symantec Security Response.

III. Update your anti-virus software and rescan your computer

SBC Internet Services strongly recommends that all Members install and maintain anti-virus software and firewall software to prevent these types of computer threats. After removing Sasser or Gaobot, update your anti-virus software and immediately rescan your computer to check for other viruses.