lsass.exe (0xc0000005) keeps terminating/sasser worm

[Socom]

A couple of days ago i turned on my computer and it kept restarting every few seconds. Once i finally got on different programs said that they were failing and had to shut down. Sometimes i could not connect to the internet too. I also noticed that my computer was running slower then it usually does. So i did a virus scan with my symantec anti-virus but it didnt find anything. I had avira installed too but i didnt do a virus scan with it. None of them found any viruses when i was downloading stuff so i didnt know how i could have got this. My firewall is on and i try my best to download the newest updates for windows and for my anti-virus programs. I googled what might be the problem and it came up to be probably the sasser worm of some sort. I looked up the symtoms an it said that sometimes you may not be able to connect to the internet and some other stuff such as the lsass.exe would fail. At first when i thought that i had the sasser worm when i booted up my computer i didnt get the little popup thing saying that the lsass.exe process has failed. So i thought maybe i didnt have it. A lot of people said to download AVG and Malware bytes and some other programs. I downloaded them fine but when i try to install them they wouldn't work because of different reasons. The page where i saw information about the sasser said that it may block websites like anti virus and stuff like that. It didnt block the pages and the downloads it just wouldn't let me install them which probably could of helped. I also tried manually deleting it but when into the registry editor to try to find it...it wasn't there so then i though maybe i dont have it. I turned on my computer today and the lsass.exe thing pops up and now i cant get into the desktop thing. I cant even go into safe mode. (By the way im on my laptop.) Can anyone tell me if it is indeed the sasser worm and how to try to get rid of it. Like i said before i cant get on my computer even in safe mode. Can someone please help me get rid of it. Thanks

[SillyBilly]

http://support.microsoft.com/kb/841720
Hope this helps!!!

[Asphodel]

Hi,

here's an article that might be of some help.

[jholland1964]

One BIG reason for the computer running slowly is you have stated that you have two anti-virus programs on the computer, Norton and Avira and then you said you downloaded AVG and Malware bytes and some other programsbut they wouldn't either install or work. I am not surprised. The absolute rule is ONE antivirus program only, not multiple ones. A really easy way to get an infection on a computer is running two anti-virus programs on the same computer. They end up conflicting with each other and then allow infection onto the computer.
If Norton is current, up to date then UNINSTALL ALL of the other anti-virus programs on the computer immediately. Note it say UNINSTALL using Add/Remove.
I don't know what the "other" programs you downloaded are but uninstall those as well, but I do need a list of what those are.
Whether you have an infection at this time it is very hard to say since you had such a multitude of security programs battling it out you likely would not have gotten a clean and thorough scan with any of them.

Uninstall MBA-M also and download it again. Follow these instructions for it's use:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Reboot the computer

Next please download and run a system scan with HiJackThis . Save the log.

Post back here with the MBA-M log and the Hijackthis log.

[Socom]

The problem is that i cannot boot up my computer. When i do it says that the lsass.exe has terminated unexpectently or some thing like that. I press ok and nothing happens it just sits on the screen and dosen't do anything. Im trying to find a way to boot up my computer so I can do these things. By the way i cant boot into safe mode either it does the same thing. I heard somewhere that you can use the ultimate boot disk to do something about it. Problem is that my friend gave me this computer and he didnt give me the disk. Any advice on starting up my computer.

[Socom]

I forgot to say that it may not be a virus but a problem with the registry. I heard that the lsass.exe is some thing to do with passwords and things. When the thing pops up it says that "lsass.exe application has failed to initialize"then the error code (0xc0000005). So it does not say that it keeps terminating.

[jholland1964]

I will be honest here I have no idea how to help you. I will ask one of our other mod's to take a look.

[jholland1964]

Checked with crunchie and here are the two solutions you might try:
Ultimate Boot Disk as you have heard, though neither of us has used it we have heard good things about it. You would have to download and burn a disk using another computer.
http://www.ultimatebootcd.com/tutorials.html

Also this one too:
Can also try Bart's PE Builder, same thing, download and burn.
http://majorgeeks.com/Barts_PE_Builder_d4007.html

Other than those two options we really have no other suggestions. Sorry we can't be of more help.
Let us know how things work out.

[Socom]

Checked with crunchie and here are the two solutions you might try:
Ultimate Boot Disk as you have heard, though neither of us has used it we have heard good things about it. You would have to download and burn a disk using another computer.
http://www.ultimatebootcd.com/tutorials.html

Also this one too:
Can also try Bart's PE Builder, same thing, download and burn.
http://majorgeeks.com/Barts_PE_Builder_d4007.html

Other than those two options we really have no other suggestions. Sorry we can't be of more help.
Let us know how things work out.

I downloaded the ultimate boot disk and burned the ISO program to a disk. I put it in my computer and pressed F9 at the begining to get the boot menu. I pressed enter on the CD drive but nothing happened. Any advice.

[jholland1964]

You normally then have to shut the computer down then reboot, that would be when the computer should boot to the CD drive. Setting up the boot menu just tells the computer what it should boot to when started up.

[Socom]

I tryed what you said and it still didnt work. Ive also heard i could do a repair installation with the windows xp professional boot disk not the ultimate boot disk thingy. The problem is that i dont have it my friend gave me the computer. Is there a downloadable version of it?