SASSER VIRUS INFO - lsass.exe terminates with an error code

July 17th, 2004, 11:31 pm

Great help topic here. I'm trying to buy some more time to download the patches, but the command 'shutdown' does not work for me on Windows 2000.

Start > Run > shutdown -a
"Cannot find the file 'shutdown' (or one of its components). Make sure path and filename are correct blah blah blah...."

Prompt> shutdown -a
'shutdown' is not recognized as an internal or external command, blah blah...


Anyone know the command to abort the shutdown on Win2K?

July 18th, 2004, 2:59 pm

Ok after some searching around, I'll answer my own question so that someone else may benefit.

shutdown.exe is not included with Win2K, but is offered as part of the Windows 2000 Resourse Kit ($69.99)

Some Googling turned up a link to that single file itself at this site.


Thanks for this helpful topic.

[ATNO/TW]

July 18th, 2004, 5:18 pm

We are delighted that you found useful information in it. And thanks for the updated tip. That was information I was unaware of. Welcome to OZZU.

August 2nd, 2004, 4:01 pm

Hey guys just an update! The Sasser worm will make it so you can't log on. It happened to me the only way to fix it at this point is to reload.

August 17th, 2004, 4:42 am

Hey guys im mat. Im not exactly a computer genius but i know a thing or two about sasser. I still have it and have had it for months now. It's a tricky bastard. Ive downloaded loadsa removal tools for it but none seem to work It seems to work in the exact same way a blaster which i have also had in the past, but that was easy to get rid of. That is a small window pops up after about two minutes of being on the internet. It tells me that isass.exe has unexpectadly terminated and the system will shutdown in sixty seconds. In response to someone earlier let me please make it clear: isass.exe is not the virus; do not modify this file otherwise u will be pretty screwed. The reason the system is restarting is because the virus has corrupted a windows file so after so long of the port being opened to the internet it terminates isass which is the cause of the system reboot. It works in the same way to blaster, the blaster virus causes the process RCE to terminate which pops up the same window.

Now i've only just turned 14, therefore if you are in the same situation as me of not being able to remove the virus i'm afraid i can't help you there. However I have told you what not to do and your decission to listen to me or not is up to you.

Someone else had a query on temporarily preventing the shutdown on a 2k computer i believe. You said you tried opening run and executing <shutdown - a> or <shutdown /a>. I have another solution of which i quite luckily stumbled upon. Now as long as the window pops up displaying the time left until shutdown this should work. All you have to do is turn your clock back a few hours! That's it. However make sure you don't turn it back over midnight to the previous day. For example: the time is 01.00 don't turn it back to 23.00, otherwise this will cause immediate reebot.

Thankyou for your time and i hope i have been some assistance of what not to do. Please post if you have any solutions for me.

Mat

August 18th, 2004, 10:04 am

Hey guys it's me again (mat) Does any1 know how 2 make an external hard drive your main drive and your current one the slave,

thanks in advance

August 19th, 2004, 6:54 am

Hi there i'm mat (again, more questions), i just made a post regarding sasser worm on the board entitled summin like "lsass.exe terminates with..." I was kinda hoping u could help me. I've had it for a while now, and just can't seem to get rid of it. Iv'e tried downloaded various removal tools and none seem to find it. I have sophos antivirus and downloaded .ide files for the different variants of it (a-f) that didn't work. It must be sasser cos after being on the internet for about 3 mins it terminates the process lsass.exe - making the window thing pop up giving me 60 seconds until it reboots. I know how to prevent it rebooting though. It seems to work in a similar way to blaster though the RCE process isn't terminated.

Also I have a couple of other questions: can it gradually become more unstable. Someone posted about lsass being totally wrecked and the pc not even being able to reach the desktop before reboot. Could this happen to me cos i've had sasser a long time...

My final question is about a solution someone posted on the same board. If I were to buy a new external hardrive which plugs to my usb port, could I make that the main drive and my internal one the slave or would I have to get someone in to fit a whole new internal one; and if so could I still use my current internal one as an external slave.

Thankyou for your time reading this message, perhaps you could read my posted messages as well if time allows. A response would be appretiated very much.

Mat

August 20th, 2004, 5:15 am

does anybody know how the virus came so that it can be avoided, is it spread through network computers or just from the net off some websites

August 23rd, 2004, 10:15 am

It spreads through the net piggy backing on downloads and email

August 23rd, 2004, 10:37 pm

I know that but piggy places like what, be more specific

August 27th, 2004, 6:54 am

Here is a link on all the different sasser worm varients I found it at McAfee
http://vil.nai.com/vil/alphar.asp

September 1st, 2004, 2:11 pm

Hi,

I have the same problem on my laptop running on XP. I get the whole shutdown in 60 secs msg and this happens even when Im off the internet. I ran the sasser and blaster removal kit and it came up saying that I did NOT have either of the worms on my machine.

Ive faithfully gone thro all 6 pages of this thread - almost everyone whio has this problem has one of the worms in their system. So has anyone seen this msg pop up when the worm is not there? Or am I not running the right tool to find the worm? I am not able to doing anything for 5 mins at a time on my laptop, its maddening, please help!

thanks,
lalitha.

September 20th, 2004, 11:58 am

On windows 2k, the best way to stop LSASS from crashing is by running the following in the command prompt:

echo dcpromo >%systemroot%\debug\dcpromo.log & attrib +r %systemroot%\debug\dcpromo.log

If you're already infected, or think you are, look for these signs and kill the process if it's running in the task manager

anything with 4 or more numbers and “_up.exe” (for example, 12345_up.exe)

anything starting with avserve (for example, avserve.exe, avserve2.exe)

or the following processes: skynetave.exe, hkey.exe, msiwin84.exe, or wmiprvsw.exe


Haven't tried the dcpromo.log fix on XP, should still work though.

If all else fails, there's always housecall.antivirus.com.

Good Luck.

October 2nd, 2004, 11:10 am

Hi All,

Okay, I'm having problems. My laptop is running winxp home. I had a corrupt win32/config/system file. I used recovery console and renamed the
old system file. I then went to my repair folder but only found a system.bak file. I copied it to my system folder and took off the bak extension. Now I get the lsasse.exe error message at boot up and it won't let me get to the desktop. So I try to go to recovery console again, (I was going to replace the new system file with another from my desktop) but the recovery console won't let me enter without a admin password!!! What?! I never used one on my laptop before! Was there a default password on that
system.bak file? Please help! My last resort is to take out the hdd and stick it in my desktop, get my important files and do a fresh install.

Byron

October 22nd, 2004, 10:25 pm

I have noticed that in my taskmans process that there is lsass
This lsass.exe has problems, its memory usage keeps raising. normaly it would be about 5mb usage. But after an hour of being online it is over 200mb usage. This extremely lags my computer once it passes my 512mb limit. I read on a website that if you have this virus it disables access to anti-virus websites. Well because of that i cant download the removal tool. I did a scan with my AVG antivirus and a scan on microsoft.com they both found nothing.

MY svchost.exe uses tons of CPU now! Before it was always under 1%, now it is never under 20%. This lags my computer also when im running other stuff.

When i play this game called 'Stronghold' it lags more then it used too. The taskman says it uses around 100% cpu. Before i got this virus or what ever it is, it was never over 10%.

I hope someone can help me, if not thanks anyway for having a great site like this up to help out people.