bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

paywallTypes

createdDate

publishedDate

sponsorType

urlAlias

moreOnThisArticles

commentCount

authorLocations

authors

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

articleSpeeches

socialHeadline

headline

images

flag

firstTopic

glossary

flattenTypeIds

image

relatedLinks

relatedNewsletters

__typename

sponsor

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

I have recently had  problems with my Dell Inspiron notebook. It shuts down unexpectedly with  the following error message: 'Lsass.exe quits unexpectedly with status code 1073741819'.

I have tried looking this up on the internet but it is all geek-speak to me.  Please  explain in simple English:  

a) What the problem is; 

b) Whether there is a step-by-step idiot's guide to fixing it; and 

c) What  notebook PC users should do to prevent such problems.  


Befuddled,
Hong Kong



As one might expect, Tech Talk has received several inquiries about this problem in the past week. Your machine has been infected with the Sasser worm, and getting rid of it may depend on several things. 

The first thing you should do is visit the homepage of your anti-virus vendor and download the latest update or any other software they advise. 

Both Symantec and Trend have solutions, Trend's being possibly a little easier to use. If neither  works, you may have to restore your machine. That would be the most painful solution because it means using either Dell's restore disk, which means losing all of your data, or Microsoft's advice, which is fairly complicated.

Symantec's solution is at securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html. Trend's solution is at kb.trendmicro.com/solutions/solutionDetail.asp?solutionId=19751. Microsoft's advice is at www.microsoft.com/security/incident/sasser.asp.

The Hong Kong Computer Emergency Response Team Co-ordination Centre  gives a fairly detailed account of the problem at its website www.hkcert.org/valert/vinfo/w32.sasser.worm.html. 
Michael Gazeley, managing director of  Network Box,  says his company has been following the worm since it was first discovered. 
'Network Box is closely monitoring this worm and is recording roughly one attack per IP address in Hong Kong every 15 seconds,' he said. 'As this is a worm and not a virus, you do not have to receive a program or an e-mail to become infected. All you have to do is connect to the internet without having installed the required Microsoft patches, which were released on the 13th of last month.'  
There are really only three ways to protect yourself in future. 
 First, you must make certain your operating system has the latest Microsoft security patches. Recent attacks (including Sasser) have been based on the fact that many people do not update their systems fast enough. The second thing you must do is keep your virus protection up to date. 
The third thing you could do is move to another operating system, though I suspect this may seem a bit radical and there may be all sorts of reasons why you cannot. One day the Linux and Mac platforms may be attacked as frequently as the Microsoft platform, but for now Windows is the big target. 
 One last thing:  back up your important data. If you really must reinstall everything, you will want  a backup of your work.

Questions to Tech Talk will not be answered personally. E-mail Danyll Wills at tech.talk@scmp.com.




Nimble moves to sidestep a pesky computer worm