Lsass.exe

[sgtx11]

When i boot my windows xp home edition up i get error
Lsass.exe and then when i click ok it reboot and it just
keeps doing the same thing. I found lsass.exe and rename it
to lsass.old now my pc just boots up and hangs at the
openning screen. I can not even boot into safe mode please
help?

 

[MGGP]

LSASS.EXE is a critical Windows component, you can't just
re-name it at will. You probably have the SASSER virus.
To prevent the virus from shutting down Windows (after you
have re-named LSASS back to its correct name and after you
receive the shutdown message) go to Start, Run and type in
shutdown -a then hit OK. Next download Stinger, and run
it, it will remove the virus. Go to
http://vil.nai.com/vil/stinger/
Turn on your Internet Connection Firewall, update your
anti-virus software (and run it), get an anti-spyware
program (free, search Google for SpyBot or AdAware), post
back if you need to . . . Good Luck !

 

[jeff]

The only problem i have is that i cant get into windows, it
just hang at the openning screen. The only way i can get
into windows is using a winintrel cd that allows me to boot
from the cd and see all the files. I cant find the file i
rename anymore and i replace with one from another working
windows.

 

[Greg]

-----Original Message-----
When i boot my windows xp home edition up i get error
Lsass.exe and then when i click ok it reboot and it just
keeps doing the same thing. I found lsass.exe and rename it
to lsass.old now my pc just boots up and hangs at the
openning screen. I can not even boot into safe mode please
help?
.
I just finished working on a friend's Dell lap with

XP,opening IE would sometimes crash the system and
reboot,giving the lsass.exe message.Turns out the system
was infected with 3 worms,the SasserB.,Welchia and
Blaster.The OS was never updated with the security
patches,etc.I was able to go to Windows update,and after a
few attempts to stay online long enough to get the Sasser
fix from Windows Update,that took care of the Sasser and
Blaster.The system had Norton AV,which had expired last
year,so i downloaded the 3 worm removal tools from the
Symantec site and the Welchia tool took care of that
worm.Note:Turn off Windows Restore before you use the tools
(an .exe file which runs a few minutes)otherwise when you
reboot you could have the same problem again.After using
the tool and rebooting,scan your entire system and if all
is ok,then you can turn on System Restore again.Greg
(e-mail address removed)