Sasser worm??

I get this error when I login to windows.
“Windows cannot find C:\WINDOWS\system\lsass.exe …(some other stuff)…”
I have to CTRL-ALT-DEL the message and only then can I resume.
I searched some website, and they say that the ‘sasser’ worm has infected the lsass.exe file… But in their case, the error message was different
any ideas??
I even tried the Symante Sasser Fix tool but it doesnt detect it…
I have McAfee Total Protection, even it doesnt detect a thing.

What Operating System are you using ? is it up to date ?

I doubt you have the Sasser worm if your system is up to date it shouldn’t be vulnerable to the sasser worm.

It may be nothing more than a missing file although that file is an important system file, have you done a search for it on your C:\ drive ?
It should be in the system32 folder, I also have another copy in the windows\servicepackfiles\i386 folder, I don’t know if you also have that (possibly not). If so copy it into the system32 folder.

:slight_smile: Hi :

 This is the Avast Support Forums; since you have McAfee "Total
 Protection" ( does NOT seem to be totalling protecting !? ), you should ask
 for Help on THEIR Support Forums .

I meant “I have tried McAfee”, sorry for the typo.

I am a reletively new user to Windows, so, I dont think I have updated ever.(but I do have SP2)
So, if I go to the microsoft windows update website and update through the “express update” button, will I get the current updates plus all the previous ones??

Please clear me on this topic.

And, most of the other queries about Lsass.exe errors have also written that their computer cannot boot, and/or it shuts down automatically. But that is not the case with me, I can boot just fine, except just this error.

And, I do have the lsass.exe file in my C windows system32 folder…

Hi phoenixankit.

Please Click here to download HJTsetup.exe

[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

If you have SP2 you should be safe from sasser, but you do still want to keep Windows up to date. Let’s have a look at the HJT log first, though.