TechSpot

Urgent-lsass.exe System Error

By Arty
Apr 11, 2007
Topic Status:
Not open for further replies.
  1. I'm not sure if this is a virus or what. I booted up my computer and got onto the boot screen for Windows XP Pro then a window popped up and said:

    lsass.exe - system error

    an invalid parameter was passed to a service or function


    So after you click OK, it reboots and its a cycle of this..

    I have already tried Safe Mode, exact same thing happens..

    I tried using Windows XP Boot CD, Last known good configuration, that didn't work.

    I can't get onto my computer at all.

    If the only way is to reinstall Windows XP, my harddrive is on a partition, is there anyway to not wipe out files on one of the partitions, the one that doesnt have Windows XP files, just personal files.

    I can't run an antivirus or anything, Windows XP wont boot so I cant run any programs.

    Thanks for your time and help.

    P.S. I'm currently using a public computer.
     
  2. jwinathome

    jwinathome TS Rookie

    Its a classic worm....I don't know if I am allowed to give you "security" advice so I will refer you....

    Follow these steps in removing the Sasser worm.

    1) Disconnect your computer from the local area network or Internet

    2) Terminate the running program

    * Open the Windows Task Manager by either pressing CTRL+ALT+DEL, selecting the Processes tab or selecting Task Manager and then the process tab on WinNT/2000/XP machines.
    * Locate one of the following programs (depending on variation), click on it and End Task or End Process

    avserve.exe
    avserve2.exe
    skynetave.exe
    any process running with the "_up.exe" suffix

    * Close Task Manager

    3) Activate the Windows XP Firewall (if running Windows XP) or another firewall to prevent the worm from shutting your system down while downloading the patches. To activate the Windows XP firewall, follow these steps.

    * Click on Start, Control Panel
    * Double-click on Networking and Internet Connections, then click on Network Connnections
    * Right-click on the connection you use to access the Internet and choose Properties
    * Click on the Advanced Tab and check the box
    "Protect my computer and network by limiting or preventing access to this computer from the Internet"
    * Click OK and close out of the Network and Control Panel

    3) Download and Install the patches for the LSASS Vulnerability and others

    * Microsoft Windows NT® Workstation 4.0 Service Pack 6a
    * Microsoft Windows NT Server 4.0 Service Pack 6a
    * Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
    * Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, and Microsoft Windows 2000 Service Pack 4
    * Microsoft Windows XP and Microsoft Windows XP Service Pack 1
    * Microsoft Windows XP 64-Bit Edition Service Pack 1
    * Microsoft Windows XP 64-Bit Edition Version 2003
    * Microsoft Windows Serverâ„¢ 2003
    * Microsoft Windows Server 2003 64-Bit Edition

    5) Remove the Registry entries

    * Click on Start, Run, Regedit
    * In the left panel go to

    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>Current Version>Run

    * In the right panel, right-click and delete the following entry

    "avserve.exe"="%Windir%\avserve.exe"
    "avserve2.exe"="%Windir%\avserve2.exe"
    "skynetave.exe"= "%Windows%\skynetave.exe"

    * Close the Registry Editor

    6) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well)

    * Click Start, point to Find or Search, and then click Files or Folders.
    * Make sure that "Look in" is set to (C:\WINDOWS).
    * In the "Named" or "Search for..." box, type, or copy and paste, the file names:

    avserve.exe
    avserve2.exe
    skynetave.exe
    C:\win2.log
    * Click Find Now or Search Now.
    * Delete the displayed files.
    * Empty the Recycle bin

    7) Reboot the computer and update your antivirus software, and run a thorough virus scan using your favorite antivirus program.

    For Automatic Removal of Sasser, download the Symantec removal tool, you'll still need to download the patches above and install them, however this removal tool will stop the Sasser worm from running, remove the items in the registry, and delete the infected files.

    The above information can be found @ http://www.pchell.com/virus/sasser.shtml
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.