Created
Updated
Viewed
151.6k times

Every twenty minutes or so, I get a message stating that lsass.exe has terminated with a bunch of numbers and the system will shut down in 60 seconds. I am running Microsoft Windows. What is happening, and how can I fix it?

add a comment
1

23 Replies

  • Votes
  • Oldest
  • Latest
Replied
Updated

You have a worm which is called the Sasser Worm.

It hits the Lsass.exe 's vulnerability. If you have antivirus then update it and scan your PC. If not try a web scan from some of the biggest companies like Norton Mcafee or TrendMicro.

Also, update windows and obtain the latest patches.

In case it's the worm/virus which I'm 90% sure, this is what you should do to stop the Sasser Worm:

  1. Open Windows Task Manager by pressing CTRL+SHIFT+ESC.
  2. In the list of running programs, locate the malware file(s) detected earlier.
  3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
  4. Do the same for all detected malware files in the list of running processes.
  5. To check if the malware process has been terminated, close Task Manager, and then open it again.
  6. Close Task Manager.
  7. Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup. To remove the autostart entries do the following:

  1. Open Registry Editor. To do this, click Start, type Run, type Regedit, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE > Software>Microsoft>Windows>CurrentVersion>Run
    
  3. In the right panel, locate and delete the entry or entries:
    avserve.exe = %Windows%\avserve.exe
    
  4. Close Registry Editor.
  • 0
    Here are some of the processes running. I've done searches - but no info. I ran ad-aware and got rid of a lot of bad stuff but some are still there including avserve.exe, avserve2.exe, hognubn.exe, and rundll32 cwcprops. — dimchandeliers
  • 0
    Two posts on the Sasser worm in one day. Now I need to go look this up and find out what it does and how it replicates so I don't have to go around fixing a bunch of computers next week. — Mark Bowker
  • 0
    Thank ATNO/TW and UNFLUX ๐Ÿ˜. Actually, the worm is like Witty, it doesn't spread through mail, it just needs to see that you're online. I'm wondering what Microsoft process doesn't have the vulnerability. ๐Ÿ˜ฑ — Ragnar78
  • 0
    The same is happening to me, it's Worm Sasser. I keep deleting it with Norton but it keeps coming back. Every time I come on it says LSA Shell (export version) error. After about 20 - 40 minutes it will then start the NT AUTHORITY/SYSTEM crap and give me 60 seconds. — Scar
  • 0
    Symantec has a removal tool for W32.Sasser.Worm and W32.SasserB.Worm. You do not have to have Norton or Symantec AV protection to use the tool. — Mark Bowker
  • 0
    Don't forget to update windows. It's a patch that is needed and not only a removal tool. Actually, Sasser doesn't need to be sent by email or executed to be activated on a PC. You just have to be connected for it to work. — Ragnar78
  • 0
    Regarding this worm w32/Sasser.A, if I get infected with it besides using protection, can I get rid of it by reformating and reinstalling the system? — The^Watcher
  • 0
    I knew when I read these posts over the weekend, I'd have to be fixing this on somebody's machine, sure enough, I'm sitting here with one of our executive's 80-year-old mother's computer with Sasser, Welchia, and Blaster on it! *lol I'll let you know how it goes. — Mark Bowker
add a comment
1
Replied
Updated

I searched the net for lsass.exe error, and came to this forum, and saw this post of my exact problem.

I followed everythign that was said to do, but it would seem it didn't do much for my computer, it still comes up with the error after about 20-40 mins and restarts, just to do it again after another amount of time.

  • I've deleted the autostart file from the registry and closed it from the task manager
  • I've ran the Symantec removal tool and it said I didn't have the virus.
  • I'm downloading an antivirus even though I've scanned my computer and that's how I got rid of what I first came upon which was a file MSBLAST.exe.

Can somebody please help me out? I even did a system restore, so I have no programs on my computer which means it does not have the updates for Windows and I can't get them because it takes longer than 20 mins to get them.

  • 0
    Actually the MSBlaster Worm does the same thing (in a very simplified way) as Sasser, they both shut down your PC. Now honestly, I suggest you try and grab all the windows patches through Updates. Sasser can only be removed by the Norton Removal tool, but it can reinstall itself easily due to a Flaw in the Lsass.exe that needs to be patched. So no matter how long you remove it, you will still grab Sasser. The same goes for MSBlaster. You can remove the processes but you will get it back again due to a Flaw in the Dcom RPC that Microsoft Windows uses. So if you are attacked with MSBlaster or Sasser, no matter how tough the AV you have, you will still be infected. Now the only solution I find, since you cannot update correctly, is to set your Firewall to the Highest possible security level. — Ragnar78
add a comment
0
Replied
Updated

There are a couple of key things in avoiding a reoccurrence.

  1. Make sure you have the patch installed. The patch was released on April 13 in critical updates and you should install it if you haven't done so already. You may need to run the worm removal tool first before downloading the patch if you hadn't done so prior.
  2. The patch should take care of things, but if you are on XP enable the Firewall, or get a firewall program like ZoneAlarm, or use Symantec's or McAfee's Firewall if available.
  3. If you are on XP, make sure you disable the "restore" as described in the Symantec security response article before running the removal tool.
  4. In the last 30 days, there have been over 100 viruses/trojans/worms identified. Here are some "best practices that Symantec recommends:

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.

If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.

Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.

Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.

Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.

Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.

Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

If you have a hardware firewall or your company uses a hardware firewall you should be at low risk on Sasser. BTW it appears two more variants appeared over the weekend.

add a comment
0
Replied
Updated

Hi guys, I need some help. I definitely have this Sasser worm going on but the fix-it tool from Microsoft doesn't work. I am not a computer genius in the least I stumbled across this site trying to find a solution to this problem. If anyone has any tips for me it would be great.

  • 0
    What OS? XP or Win2K? Read everything I just posted above you. I gave every detail I found today. The Firewall is particularly important (especially if you are on broadband), because if your ports remain open, the attacking computer may find you again easily and reinstall it. Try the removal tool from Symantec. It worked for the one computer I had that was infected. — Mark Bowker
  • 0
    Zonealarm is a good free firewall (for personal use) and as long as your not trying to do anything complicated over the net the default install should be fine. Otherwise it may need some fiddling if you do VPN's or gaming etc to get it working properly. A big agree on the Symantec removal tools. Use them all the time. They take forever to run, but work very well. By the way, this site is number 4 on the list if you do a search in Google for 'Removing Sasser' so you may get a few hits to this thread ๐Ÿคฃ — DuckIT
  • 0
    The best firewall I ever tested while gaming, or surfing on the net was the Built-In firewall in my AV, PC Ciliin Internet Security 2004. When I use the Direct Connection option for the firewall and test my PC with the Norton Security Response web, my PC is Stealth all the way, and games never lag, not a bit, and don't even drop the connection. This is why I hate Zonealarm, it's good at what it does, but a bit TOO good that you have to drop the protection to be able to play games or upload to the web, etc. — Ragnar78
add a comment
0
Replied
Updated

I have tried deleting the lsass.exe in the running processes window. I am denied access even though I am an administrator. I have also tried running the removal tool I downloaded from Norton. It comes back saying that there is no Sasser Worm on the computer. What am I missing?

We have 2 computers with lsass.exe in the running processes both windows 2000.

  • 0
    lsass.exe should be running on both computers aggie. That's not the worm. That's the Windows service that the worm tries to exploit. You should be OK. — Mark Bowker
  • 0
    lsass.exe is one of them spooky critical system processes. As ATNO/TW said, the worm infects a vulnerability in it. Welcome to Microsoft ๐Ÿ˜  — conorific
add a comment
0
Replied
Updated

To everyone else: thank you for replying. I came back here a few days after I started the thread, because I found it on my laptop (gar!) and it came back after I tried to remove it. Good thing I discovered all the info here.

I'm going to run the Symantec tool, download Windows patches and crank up the firewall. I'll let you know if anything else happens.

In the meantime, I've just had the Task Manager open so I can kill inetman.exe and cool.exe when they come up on the list of processes. Works so far.

le sigh

  • 0
    Maggie's bewildered! I ran the Symantec tool, and, behold! I HAVE NO WORM. But five minutes before, NT AUTHORITY killed my computer after 60 seconds. What the hell happened? — conorific
  • 0
    Dont question your luck ๐Ÿ˜ As long as you applied the patch and didn't find the worm, its good ๐Ÿ˜‰ — Ragnar78
  • 0
    But that's just it! I didn't do aaaaaaaaanything. Cursรจd computers. Whatever. — conorific
add a comment
0
Replied
Updated

I must admit I don't know the full info on this virus, but have seen a similar problem to yours today.

I was working on a poor guy's computer who had got this over the weekend. When I arrived his machine was in a constant reboot loop (I.E. it crashed & burnt before even hitting the desktop. Safemode was screwed too!). He told me of a system message he got earlier regarding LSASS.exe so I pretty much guessed it was the Sasser virus. Because of the reboot loop I had to use a disc to load the machine (I use the excellent ERD commander by Winternals) this allowed me to run the Symantec tool, and sure enough, I found 18 copies of the virus!

Unfortunately, even with all of the above, his machine was still constantly rebooting. I tried a few more things but in the end, had to rebuild the OS. Even tried an in-place upgrade to keep his settings but that did the same thing! Man, this virus can suck! ๐Ÿ˜ˆ

I can only guess that perhaps there is some destructive element of Sasser that can occur that may be wrecking lsass.exe? It's a pretty essential service.

  • 0
    Eeeesh. I'd hate that to happen to my computer. grabs CPU and holds it protectively Is there any word on who's coming out with the miracle fix to kill this thing? If it's anyone, it ought to be Microsoft. Grar. Silly MS. — conorific
  • 0
    Im having the same problem I have the virus as well, right now I have ME installed should I install XP then get rid of the virus or get rid of the virus then install?? ๐Ÿ˜ฑ dam virus ๐Ÿ˜ˆ — -DaVinci-
  • 0
    If you intend to install XP anyway, installing it will basically give you the option to format your drive. That will nix the virus and all the other files on your computer, so do a backup first if you can, (but may not prevent you from getting it again). Windows XP does come with a built in firewall. In my opinion, it's not the best I've seen, but at least it is one. You access it by going to network properties on your network connection and clicking the advanced tab. If I recall the option will be there. (Sorry if that's not 100 percent right that's from memory.) If you do install XP, make sure your first step after your driver and chipset install is to download the current critical updates. Those should include the updates that will reduce the risk of the sasser exploitation of the lsapp vulnerability. — Mark Bowker
add a comment
0
Replied
Updated

OK, I'm having a huge problem. I know it's Sasser because the computer just keeps rebooting. Uhh, I can't even get into Windows with Safe mode before it reboots itself. When the whole warning thing came out, Microsoft refused to let me download a security update. No, my XO is not cracked. Microsoft is just a bunch of bastards. Their Sesser helpline doesn't even work.

Uhh... Anyway, this began two nights ago when I got back from work. The computer screen was completely frozen, and when I rebooted the computer it just kept restarting. PLEASE tell me I don't have to wipe my system.

  • 0
    Umm sorry, but yes the only resolve I found to this was a rebuild (when it goes into this nasty reboot loop and you cant even get to the desktop) See my post above on all the things I tried when it did this. Hoping someone can suggest something better though! — DuckIT
  • 0
    shudder I'm an artist, and I'll be hideously screwed if I have to wipe the computer, but if I absolutely have to, I'll do it. Thanks for the suggestion, every little bit of advice is appreciated! — FunkerMitis
  • 0
    This may be far-fetched, but I am able to boot the computer from the CD drive using BIOS and all that wonderful stuff... If I, perhaps, wrote a CD with something that could get rid of Sasser, would that MAYBE work? I just rolled out of bed and have devoted this whole day to figure this out. — FunkerMitis
  • 0
    What your suggesting may work if you knew what was wrong with Windows - I.E. which files are corrupted or whatever the problem is. I was unable to do this so good luck! What's the problem with rebuilding? Loss of data I take it? If you can get a program similar to ERD commander to access the files then you can maybe copy them to floppy or something. The data itself should be there still, it's just Windows that's dead. It's just getting at it that can be fun! Another idea if you have a spare hard disk would be to replace your current hard drive with that, load Windows onto it, then attach your old virused drive as a slave, and copy all the data off that way. Then once you have the data backed up you can rebuild the first hard drive no problem! — DuckIT
  • 0
    Yeah, I'll look into getting that program because my artwork is sorta crucial to everything. GRRR to digital art heh. I'll see about creating a system backup and everything. Thanks for the help! — FunkerMitis
add a comment
0
Replied
Updated

For the record, in case anyone didn't know, typing shutdown -a in run will stop the shutdown process.

Was very helpful when I'm trying to remove the stupid thing, giving yourself a minute isn't very useful. ๐Ÿ˜‰

For the record, when I first tried to remove it, I was under the impression it was the blaster worm until I figured out that lsass.exe was causing it all the time.

As of the update, squeaky clean and working fine, as it did before the stupid Sasser worm.

Don't worry about making CDs or anything silly for it, it's really not necessary. Just check out Symantec's site, grab the fix, and patch it up (after running shutdown -a, or you'll never have time to do it ๐Ÿ˜‰ )

add a comment
0
Replied
Updated

After I connect to the internet (dial-up), I will soon get a message saying that the system is shutting down by NT AUTHORITY/SYSTEM. I get 60 seconds and it cuts off, it says by lsass.exe or something. When I run Norton anti-virus, it picks up the Welchia virus and the backdoor.sdbot virus. Norton was unable to delete or quarantine, it kept failing.

I found a Welchia virus tool that took it off, but I can't get rid of this backdoor.sdbot virus, Norton says it's located in windows/system32/system32.exe. I can't delete it and I tried to in regular and safe mode.

I really would appreciate someone giving me step by step to get rid of this thing.

Last night I used the run: shutdown -a, and downloaded all the current critical updates from Microsoft, like 13 of them, and then turned my computer off.

  • 0
    What on earth? Welchia has nothing to do with the lsass exploitability. It sounds like your computer has a lot of problems ๐Ÿ˜Ÿ Ok, here's my suggestion on what to do: 1. If Welchia is gone, then get rid of the backdoor, if nothing else, adaware or other generic removal programs might even work on it. 2. Restart your computer, if the window pops up use shutdown -a and follow the link that I posted in the last post to get rid of your lsass problem. 3. Restart your computer again, and be happy. (Unless you have random other viruses? ๐Ÿ˜‰) — Joyous
add a comment
0
Replied
Updated

So I removed the worm with the removal tool and installed the MS patch, but now I can't run my Liveupdate or load up the Symantec website. I'm thinking the worm caused this. Does anyone know how to fix this problem?

  • 0
    If you can't run Live update, then try reinstalling your Norton Antivirus. Sorry, but I don't think Sasser attacks or tries to disable AVs. Can you tell me if Sasser rebooted your PC a LOT of times? This might have affected Windows stability, so you might consider repairing it and reinstalling all the patches. And if it's only Norton that is not installing, I heard from some people that they had some problems installing it on their machines (up to 3 or 4 tries before it worked). — Ragnar78
  • 0
    I've read that 1 of the symptoms of this worm is that it prevents you from reaching AV sites like Symantec, but anyway, I tried these instructions that I found elsewhere: Open the "Hosts" file in notepad and delete everything in there apart from this line: 127.0.0.1 localhost. For me there was this big list of AV sites that included Symantec and f-secure, so I deleted all those entries and I could reach Symantec finally but my LiveUpdate still wouldn't update. I uninstalled and reinstalled my AV but no luck. I did a reboot and I was back to square one, couldn't get to Symantec again. Looked into the hosts file and saw that list in there again! I deleted the entries again and uninstalled my Symantec corp edition AV and surfing to those sites was fine. I rebooted my Windows machine and the same problem again. So it looks like to me there's some file(s) still on my system causing the problem, anybody managed to fix this problem? — zoolander
  • 0
    Turn off system restore and try again. — Mark Bowker
  • 0
    I turned off my system restore when running the removal tool and it's still off. Any other suggestions? — zoolander
  • 0
    Well, I only had to fix one computer with this worm. Unfortunately, there were two other viruses on the machine. All I did was follow the instructions exactly and used the removal tool for all three (fortunately all three had a removal tool). The only thing I did differently that I don't believe was recommended or suggested as far as I could see was turn on XP's firewall before connecting to the internet again. I made the assumption that if the perpetrator of the virus had my IP, then the machine was apt to get hit again, probably almost instantaneously. The owner of the computer hasn't had any problems since and it's been at least 3 or 4 days now, I think. Not sure if that will work for you, I'm just relating what I did, and it was fixed on the first try. — Mark Bowker
add a comment
0
Replied
Updated

Can this file Lsass.exe really be moved from your system?

I did everything to get rid of it, scanned with Trojan scanners, Virus utils, etc, etc. I later decided to do another format and a new fresh re-install of Windows.

When I got XP onto the system, I downloaded the Trojan Tools and Virus Killers Again and did another scan, and guess what, it was found on my system again, how I don't know why. I found the file in the Windows/system32 directory.

The only way to get rid of this file is to do a Safe Boot mode, and go to that directory and delete it, as you can't delete it in normal windows mode.

But I still like to know that after formatting my drive 2 times and doing a fresh re-install this poxy file was still here. I even scanned my CDs and did'nt find it, so I can only think that it must automatically download itself secretly when your first login to the internet, OR it doesn't get cleaned by any Antivirus or Trojan cleaners.

  • 0
    We already addressed the issue of whether lsass.exe can be deleted. Once again: the Sasser worm targets a vulnerability in lsass.exe. It's not lsass.exe itself that's causing the problem, it's actually a critical system process that should be there. Next time, please read more carefully and ask for clarification if you don't understand. ๐Ÿ˜‰ — conorific
add a comment
0
Replied
Updated

I was very pleased to find this page whilst searching for virus solutions. As many have written, my PC started shutting down every twenty minutes, with the same error warning. Sadly last week, it began doing it the moment I logged on to the net. Not being a computer wiz, and desperate for a solution being I couldn't search the net for one.

I got the LSA Shell lsass.exe file, and not wanting to delete it, not knowing what it was, I made it unstable by renaming it. It's all good, as I can now log onto the internet and have had no such troubles since, but my question is:

What does the LSA Shell program do?! The net appears to run as per normal without it. Should I need it, is it something I can delete and copy from a friend's computer, or will it in some way be unique to each machine?

  • 0
    Lsass is a Windows Local Security Authority Server Process that handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service. You probably don't want to be without it, but your workaround now at least gives you the chance to get rid of the worm and start fresh. Welcome to OZZU and good luck. — Mark Bowker
  • 0
    Thanks very much for making a reply, I'll take steps to get rid of the worm as advised in earlier posts. — Kal-el
  • 0
    OK -- but be careful about rebooting. Based on what you said you did, if you reboot, with your current changes to lsass, I seriously suspect, you'll never be able to logon again. And if I recall correctly, the removal tool will require a reboot, so make sure you rename lsass back before you do otherwise have your restore disk handy. — Mark Bowker
  • 0
    Nice idea though for fault finding! Would be interested in knowing what happens if it gets rebooted with it renamed. Care to try it in the name of science? ๐Ÿคฃ (I'm joking, please don't try it!!) — DuckIT
add a comment
0
Replied
Updated

Ive done everything, Ive Disabled System restore, Ive ran the sasser remove tool and ive tried to get rid of it manually. When I ran the sasser removal tool it said that lsass was not found anywhere on my computer. Then I pressed ctrl + alt + delete and sure enough lsass.exe and its possy were running. Make sense? Hell no.

  • 0
    lsass.exe is not the virus. It's supposed to be there. — Mark Bowker
add a comment
0
Replied
Updated

I have seen the strings on lSASS.exe and have the same issue - yet when I boot up, I get a blank screen and can do nothing - tried safe mode, safe mode with prompt - Am I dead in the water or is there a saviour out there?

  • 0
    Hey guys just an update! The Sasser worm will make it so you can't log on. It happened to me the only way to fix it at this point is to reload. — BSRipper
add a comment
0
Replied
Updated

Is there a way in Windows 2000 to stop the Sasser worm shutdown process long enough to upload the worm removal tools?

I'm going insane here! Thanks.

  • 0
    Start --> Run --> cmd (or command) and then you write shutdown /a which means abort shutdown ๐Ÿ˜‰ — basdog22
  • 0
    I believe it's shutdown -a (so if the /a doesn't work try that) — Mark Bowker
add a comment
0
DB
0 0
Replied
Updated

Great help topic here. I'm trying to buy some more time to download the patches, but the command shutdown does not work for me on Windows 2000:

  1. Went to Start > Run
  2. Typed shutdown -a and get:
    Cannot find the file 'shutdown' (or one of its components). Make sure path and filename are correct
    
  3. Went to Cmd Prompt this time:
    shutdown -a
    'shutdown' is not recognized as an internal or external command.
    

Does anyone know the command to abort the shutdown on Win2K?

  • 0
    Ok after some searching around, I'll answer my own question so that someone else may benefit. shutdown.exe is not included with Win2K, but is offered as part of the Windows 2000 Resourse Kit. — db
  • 0
    We are delighted that you found useful information in it. And thanks for the updated tip. That was information I was unaware of. Welcome to OZZU. — Mark Bowker
add a comment
0
Replied
Updated

I'm not exactly a computer genius but I know a thing or two about Sasser. I still have it and have had it for months now. It's a tricky bastard. I've downloaded loads of removal tools for it but none seem to work ๐Ÿ™„ It seems to work in the exact same way as the blaster virus which I have also had in the past, but that was easy to get rid of. A small window pops up after about two minutes of being on the internet. It tells me that isass.exe has unexpectedly terminated and the system will shutdown in sixty seconds. In response to someone earlier let me please make it clear: isass.exe is not the virus; do not modify this file otherwise u will be pretty screwed.

The reason the system is restarting is that the virus has corrupted a Windows file so after so long of the port being opened to the internet it terminates isass which is the cause of the system reboot. It works in the same way as to the blaster virus, it causes the process RCE to terminate which pops up the same window.

Someone else had a query on temporarily preventing the shutdown on a 2k computer I believe. You said you tried opening run and executing shutdown - a or shutdown /a. I have another solution which I quite luckily stumbled upon. Now as long as the window pops up displaying the time left until shutdown this should work. All you have to do is turn your clock back a few hours! That's it. However, make sure you don't turn it back over midnight to the previous day. For example, if the time is 1:00 am don't turn it back to 11:00 pm, otherwise this will cause an immediate reboot.

Iv'e tried downloading various removal tools and none seem to find it. I have Sophos antivirus and downloaded .ide files for the different variants of it (a-f) that didn't work. It must be Sasser because after being on the internet for about 3 mins it terminates the process lsass.exe - making the window thing pop up giving me 60 seconds until it reboots. I know how to prevent it from rebooting though. It seems to work in a similar way to the Blaster Worm though the RCE process isn't terminated.

Also, I have a couple of other questions: can it gradually become more unstable? Someone posted about lsass being totally wrecked and the PC not even being able to reach the desktop before reboot. Could this happen to me because I've had Sasser a long time?

My final question is about a solution someone posted on the same board. If I were to buy a new external hard drive that plugs into my USB port, could I make that the main drive and my internal one the slave, or would I have to get someone in to fit a whole new internal one; and if so could I still use my current internal one as an external slave?

add a comment
0
Replied
Updated

Does anybody know how the virus came so that it can be avoided? Is it spread through network computers or just from the net off of some websites?

  • 0
    It spreads through the net piggy backing on downloads and email. — BSRipper
add a comment
0
Replied
Updated

I have the same problem with my laptop running on XP. I get the whole shutdown in 60 secs msg and this happens even when I'm off the internet. I ran the Sasser and blaster removal kit and it came up saying that I did NOT have either of the worms on my machine.

I've faithfully gone through all 6 pages of this thread - almost everyone who has this problem has one of the worms in their system. So has anyone seen this msg pop up when the worm is not there? Or am I not running the right tool to find the worm? I am not able to do anything for 5 mins at a time on my laptop, it's maddening!

add a comment
0
Replied
Updated

On Windows 2k, the best way to stop LSASS from crashing is by running the following in the command prompt:

echo dcpromo >%systemroot%\debug\dcpromo.log & attrib +r %systemroot%\debug\dcpromo.log

If you're already infected or think you are, look for these signs and kill the process if it's running in the task manager.

  1. Anything with 4 or more numbers and "_up.exe" (for example, 12345_up.exe)
  2. Anything starting with avserve (for example, avserve.exe, avserve2.exe)
  3. Or the following processes: skynetave.exe, hkey.exe, msiwin84.exe, or wmiprvsw.exe

Haven't tried the dcpromo.log fix on XP, should still work though.

add a comment
0
Replied
Updated

Okay, I'm having problems. My laptop is running WinXP home.

I had a corrupt win32/config/system file. I used the recovery console and renamed the old system file. I then went to my repair folder but only found a system.bak file. I copied it to my system folder and took off the bak extension. Now I get the lsass.exe error message at boot up and it won't let me get to the desktop.

So I try to go to the recovery console again, (I was going to replace the new system file with another from my desktop) but the recovery console won't let me enter without an admin password! What?! I never used one on my laptop before! Was there a default password on that system.bak file?

My last resort is to take out the HDD and stick it on my desktop, get my important files and do a fresh install.

add a comment
0
Replied
Updated

I have noticed that in my taskman process that there is lsass.

This lsass.exe has problems, its memory usage keeps raising. Normally it would be about 5MB usage, but after an hour of being online, it is over 200MB usage. This extremely lags my computer once it passes my 512MB limit.

I read on a website that if you have this virus it disables access to anti-virus websites. Well because of that I can't download the removal tool. I did a scan with my AVG antivirus and a scan on microsoft.com and they both found nothing.

MY svchost.exe uses tons of CPU now! Before it was always under 1%, but now it is never under 20%. This lags my computer also when I'm running other stuff.

When I play this game called Stronghold it lags more than it used to. The taskman says it uses around 100% CPU. Before I got this virus or whatever it is, it was never over 10%.

I hope someone can help me, if not thanks anyway for having a great site like this up to help out people.

  • 0
    Lsass is normal the sasser worm creates the Lsass but with lower case entry (lsass or something like that) — WoRd Of WiSdOm
  • 0
    I know it is a normal file to have, but it isn't normal to use 200MB of ram, crash programs, disable antivirus websites, and a bit more. I FEEL SO PROUD OF MYSELF! I went to C:\WINDOWS\system32\drivers\host, and I opened that host file in a hex editor, went to the end of it and there was a list of all disabled antivirus websites. I deleted that section and now they work! I AM SO PROUD!!! But my lsass and svchost problems still. ๐Ÿ˜Ÿ — MacemanDerek
add a comment
0