InvisibleMan

trying to boot laptop, gets to the point of loading lsass.exe then stops so cant run windows so hd is buggered. Any ideas how in xp how you can get it not to load lsass? When i find a boot disk, what will it do? will i be able to take lsass out?

lightning101

LSASS is the sasser virus and terminates with an error code and shutdown sequence.


My advice would be to boot with windows XP CD then go to repair console and rename LSASS something else temorarily unti,l you get in and use patch to fix sasser.

ozzy

It's the local security service that validates logons. Not sure you can boot XP without loading this service.

It's listed in Services as "Security Accounts Manager", but you need to get into Windows to disable it.

Do you know the format of the HD? FAT or NTFS?

What do you want to achieve? recover local data off the drive or try to repair the existing copy?

Stefan

ozzy

You want to make sure it has been the Sasser virus that has exploited the LSASS vulnerabilities.

Have a look on the McAfee site for details on how to check if it's infected the laptop.

Stefan

InvisibleMan

yeah its got all the lastest patches but actually happened after an update was installed(dont know what it is) its ntfs & want it up & running else will have to reimage it but will need to get data of before had

ozzy

You could boot off an XP CD into the recovery console. Then look for the sasser exe files and delete them.

Then you could re-install XP over the top of the existing one, allowing you to login and copy off the data.

Stefan

Beauregard

You could boot into Safe mode. Disable System Restore and then run Stinger from Mcafee http://vil.nai.com/vil/stinger/ . If it is Sasser that should kill it off. Don't forget to turn System restore back on and update AV+Windows ASAP.

InvisibleMan

couldnt boot up in any mode.

went to recovery console & repaired windows. Had to reinstall lots of windows updates which seemed to do the trick. Was slow mind, prob quicker doing a reimage

Beauregard

Ouch!