Member Avatar for Socom

A couple of days ago i turned on my computer and it kept restarting every few seconds. Once i finally got on different programs said that they were failing and had to shut down. Sometimes i could not connect to the internet too. I also noticed that my computer was running slower then it usually does. So i did a virus scan with my symantec anti-virus but it didnt find anything. I had avira installed too but i didnt do a virus scan with it. None of them found any viruses when i was downloading stuff so i didnt know how i could have got this. My firewall is on and i try my best to download the newest updates for windows and for my anti-virus programs. I googled what might be the problem and it came up to be probably the sasser worm of some sort. I looked up the symtoms an it said that sometimes you may not be able to connect to the internet and some other stuff such as the lsass.exe would fail. At first when i thought that i had the sasser worm when i booted up my computer i didnt get the little popup thing saying that the lsass.exe process has failed. So i thought maybe i didnt have it. A lot of people said to download AVG and Malware bytes and some other programs. I downloaded them fine but when i try to install them they wouldn't work because of different reasons. The page where i saw information about the sasser said that it may block websites like anti virus and stuff like that. It didnt block the pages and the downloads it just wouldn't let me install them which probably could of helped. I also tried manually deleting it but when into the registry editor to try to find it...it wasn't there so then i though maybe i dont have it. I turned on my computer today and the lsass.exe thing pops up and now i cant get into the desktop thing. I cant even go into safe mode. (By the way im on my laptop.) Can anyone tell me if it is indeed the sasser worm and how to try to get rid of it. Like i said before i cant get on my computer even in safe mode. Can someone please help me get rid of it. Thanks

  • 4 Contributors
  • 10 Replies
  • 359 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by Socom

Dani AI

Generated

Short diagnosis and why the machine won’t reach the desktop: the lsass.exe (Local Security Authority) process is a core Windows security service; when it crashes with an access-violation code like 0xc0000005 the OS often forces an automatic restart and prevents interactive logon — that’s exactly why Normal and Safe Mode hang for you. One historically common cause of this symptom is the Sasser-family worm (it exploited an LSASS buffer overflow), but the same crash can come from a corrupted or replaced lsass.exe or related system files. (learn.microsoft.com)

Because the system won’t boot, work from clean external media on another computer: create a bootable rescue environment (ISO or USB), boot the infected laptop from that, update the rescue engine if possible, and run a full offline scan to remove active malware before trying file repairs. If the ISO you burned doesn’t boot (you said the CD didn’t respond after F9), verify the ISO was burned as a bootable image (not just copied), check BIOS/one‑time boot keys, test the disc on another PC, or create a bootable USB instead (tools such as Rufus make USB sticks from ISOs). (eset.com)

If you can use a Windows XP installation CD (matching the exact edition/service pack) the Recovery Console lets you restore the original lsass.exe copy from the CD’s i386 folder. Typical Recovery Console sequence (after pressing R at setup, picking the installation and logging in as Administrator — check the CD drive letter with map) is:

attrib -r -s C:\Windows\System32\lsass.exe
rename C:\Windows\System32\lsass.exe lsass.old
expand D:\i386\lsass.ex_ C:\Windows\System32\lsass.exe
exit

(Replace D: with your CD drive letter; if the CD and installed SP differ, use C:\Windows\ServicePackFiles\i386 instead.) Use chkdsk /r as well if disk errors are suspected. (support.microsoft.com)

If you cannot reach the Recovery Console or don’t have the right CD, remove the drive, attach it to another clean PC (USB adapter/slave), back up data and run scanners there; after cleanup either do a Repair (in‑place) install with genuine matching media or a clean install. After recovery, install all Windows security updates (to close LSASS vulnerabilities) and use a single, current real‑time antivirus — running multiple real‑time AV engines causes conflicts that make detection and removal harder (see ’s caution).

Recommended Answers

All 10 Replies

Member Avatar for SillyBilly


Hope this helps!!!

Member Avatar for Asphodel

Hi,

here's an article that might be of some help.

Member Avatar for jholland1964

One BIG reason for the computer running slowly is you have stated that you have two anti-virus programs on the computer, Norton and Avira and then you said you downloaded

AVG and Malware bytes and some other programs

but they wouldn't either install or work. I am not surprised. The absolute rule is ONE antivirus program only, not multiple ones. A really easy way to get an infection on a computer is running two anti-virus programs on the same computer. They end up conflicting with each other and then allow infection onto the computer.
If Norton is current, up to date then UNINSTALL ALL of the other anti-virus programs on the computer immediately. Note it say UNINSTALL using Add/Remove.
I don't know what the "other" programs you downloaded are but uninstall those as well, but I do need a list of what those are.
Whether you have an infection at this time it is very hard to say since you had such a multitude of security programs battling it out you likely would not have gotten a clean and thorough scan with any of them.

Uninstall MBA-M also and download it again. Follow these instructions for it's use:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Reboot the computer

Next please download and run a system scan with HiJackThis. Save the log.

Post back here with the MBA-M log and the Hijackthis log.

Member Avatar for Socom

The problem is that i cannot boot up my computer. When i do it says that the lsass.exe has terminated unexpectently or some thing like that. I press ok and nothing happens it just sits on the screen and dosen't do anything. Im trying to find a way to boot up my computer so I can do these things. By the way i cant boot into safe mode either it does the same thing. I heard somewhere that you can use the ultimate boot disk to do something about it. Problem is that my friend gave me this computer and he didnt give me the disk. Any advice on starting up my computer.

Member Avatar for Socom

I forgot to say that it may not be a virus but a problem with the registry. I heard that the lsass.exe is some thing to do with passwords and things. When the thing pops up it says that "lsass.exe application has failed to initialize"then the error code (0xc0000005). So it does not say that it keeps terminating.

Member Avatar for jholland1964

I will be honest here I have no idea how to help you. I will ask one of our other mod's to take a look.

Member Avatar for jholland1964

Checked with crunchie and here are the two solutions you might try:
Ultimate Boot Disk as you have heard, though neither of us has used it we have heard good things about it. You would have to download and burn a disk using another computer.
http://www.ultimatebootcd.com/tutorials.html

Also this one too:
Can also try Bart's PE Builder, same thing, download and burn.
http://majorgeeks.com/Barts_PE_Builder_d4007.html

Other than those two options we really have no other suggestions. Sorry we can't be of more help.
Let us know how things work out.

Member Avatar for Socom

Checked with crunchie and here are the two solutions you might try:
Ultimate Boot Disk as you have heard, though neither of us has used it we have heard good things about it. You would have to download and burn a disk using another computer.
http://www.ultimatebootcd.com/tutorials.html

Also this one too:
Can also try Bart's PE Builder, same thing, download and burn.
http://majorgeeks.com/Barts_PE_Builder_d4007.html

Other than those two options we really have no other suggestions. Sorry we can't be of more help.
Let us know how things work out.

I downloaded the ultimate boot disk and burned the ISO program to a disk. I put it in my computer and pressed F9 at the begining to get the boot menu. I pressed enter on the CD drive but nothing happened. Any advice.

Member Avatar for jholland1964

You normally then have to shut the computer down then reboot, that would be when the computer should boot to the CD drive. Setting up the boot menu just tells the computer what it should boot to when started up.

Member Avatar for Socom

I tryed what you said and it still didnt work. Ive also heard i could do a repair installation with the windows xp professional boot disk not the ultimate boot disk thingy. The problem is that i dont have it my friend gave me the computer. Is there a downloadable version of it?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.