lsass.exe - invalid HANDLE error

OK, everyone tells me this is Sasser. Norton 2004 does not fix it. All
patches for windows have been downloaded. Norton is up to date. Tried the
removal tools for multiple worms including sasser. I am behind a firewall
and router. I tried to remove it manyally as per directions at sarc.com, but
the files listed on the site are not part of my computer and the registry
files listed are not there either.

All this and yet... I am still getting a daily "lsass.exe error - Invalid
HANDLE" and my computer reboots at startup. The good news is I am still able
to eventually log on.

Am I infected? and if so, what with????

anonymous
Sat Aug 28 00:13:15 CDT 2004

Sounds like Sasser to me. This site may prove to be
helpful:
http://ask-
leo.com/what_are_lsass_lsassexe_and_sasser_and_how_do_i_kno
w_if_im_infected_what_do_i_do_if_i_am.html

To clear up the confusion as far as lsass.exe is
concerned: lsass.exe is legitimate and from Microsoft,
whereas isass.exe is a virus.

Good luck.





>-----Original Message-----
>OK, everyone tells me this is Sasser. Norton 2004 does
not fix it. All
>patches for windows have been downloaded. Norton is up
to date. Tried the
>removal tools for multiple worms including sasser. I am
behind a firewall
>and router. I tried to remove it manyally as per
directions at sarc.com, but
>the files listed on the site are not part of my computer
and the registry
>files listed are not there either.
>
>All this and yet... I am still getting a daily "lsass.exe
error - Invalid
>HANDLE" and my computer reboots at startup. The good
news is I am still able
>to eventually log on.
>
>Am I infected? and if so, what with????
>.
>

Jamik
Sat Aug 28 00:43:04 CDT 2004

Thanks... but the site was another dead end. This particular "strain" of
sasser I have somehow come across is weird. I seam to be able to get into my
computer after 8 or 9 pm (Pacific Time) with no real problems. In the mean
time I am in safe mode throwing everything I can at it.

So far I have...
Updated Windows (short of SP2)
Updated Norton (scan twice daily)
Messed with registry (although I have not found ANY of the Registry entries
that have been listed as part of sasser)
downloaded and ran spy-bot S&D
downloaded and ran spy doctor
reinstalled personal firewall software I aquired 6 months ago
ran worm removal tools for fxsasser, fxwelsh, fxblaster, fx korgo
downloaded and ran Mcafee Stinger

Everything said I was clear before my first post...

What is out there that I have not tried yet short of wiping my system or the
fustration ending/costly "sledge hammer" approach?

"anonymous@discussions.microsoft.com" wrote:

> Sounds like Sasser to me. This site may prove to be
> helpful:
> http://ask-
> leo.com/what_are_lsass_lsassexe_and_sasser_and_how_do_i_kno
> w_if_im_infected_what_do_i_do_if_i_am.html
>
> To clear up the confusion as far as lsass.exe is
> concerned: lsass.exe is legitimate and from Microsoft,
> whereas isass.exe is a virus.
>
> Good luck.
>
>
>
>
>
> >-----Original Message-----
> >OK, everyone tells me this is Sasser. Norton 2004 does
> not fix it. All
> >patches for windows have been downloaded. Norton is up
> to date. Tried the
> >removal tools for multiple worms including sasser. I am
> behind a firewall
> >and router. I tried to remove it manyally as per
> directions at sarc.com, but
> >the files listed on the site are not part of my computer
> and the registry
> >files listed are not there either.
> >
> >All this and yet... I am still getting a daily "lsass.exe
> error - Invalid
> >HANDLE" and my computer reboots at startup. The good
> news is I am still able
> >to eventually log on.
> >
> >Am I infected? and if so, what with????
> >.
> >
>

anonymous
Sat Aug 28 01:44:27 CDT 2004

First of all, regarding SpyDoctor: it's a rogue/suspect
anti-spyware product. Get rid of it A.S.A.P. and trust
only the legitimate anti-spyware products that have a long
and strong reputation like Ad-aware and Spybot Search &
Destroy.

A list of rogues that do more harm than good:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Secondly, have you read through and followed all the
things listed on the Web site I provided to you?

Have you tried Symantec.com? (They are the makers of
Norton Antivirus.) They have a Sasser removal tool; have
you tried it? (Just do a Google search for "Symantec
Sasser removal".) Unfortunately, I'm assuming you have
tried that and it didn't work.

Microsoft has information on Sasser as well:
http://www.microsoft.com/security/incident/sasser.mspx
Have you read that, top to bottom, and followed the
instructions there?

In the end, your suggestion of "wiping the system" is
probably the last alternative to return your PC back to a
desirable state.

Good luck!!!

>-----Original Message-----
>Thanks... but the site was another dead end. This
particular "strain" of
>sasser I have somehow come across is weird. I seam to be
able to get into my
>computer after 8 or 9 pm (Pacific Time) with no real
problems. In the mean
>time I am in safe mode throwing everything I can at it.
>
>So far I have...
>Updated Windows (short of SP2)
>Updated Norton (scan twice daily)
>Messed with registry (although I have not found ANY of
the Registry entries
>that have been listed as part of sasser)
>downloaded and ran spy-bot S&D
>downloaded and ran spy doctor
>reinstalled personal firewall software I aquired 6 months
ago
>ran worm removal tools for fxsasser, fxwelsh, fxblaster,
fx korgo
>downloaded and ran Mcafee Stinger
>
>Everything said I was clear before my first post...
>
>What is out there that I have not tried yet short of
wiping my system or the
>fustration ending/costly "sledge hammer" approach?
>
>"anonymous@discussions.microsoft.com" wrote:
>
>> Sounds like Sasser to me. This site may prove to be
>> helpful:
>> http://ask-
>>
leo.com/what_are_lsass_lsassexe_and_sasser_and_how_do_i_kno
>> w_if_im_infected_what_do_i_do_if_i_am.html
>>
>> To clear up the confusion as far as lsass.exe is
>> concerned: lsass.exe is legitimate and from Microsoft,
>> whereas isass.exe is a virus.
>>
>> Good luck.
>>
>>
>>
>>
>>
>> >-----Original Message-----
>> >OK, everyone tells me this is Sasser. Norton 2004
does
>> not fix it. All
>> >patches for windows have been downloaded. Norton is
up
>> to date. Tried the
>> >removal tools for multiple worms including sasser. I
am
>> behind a firewall
>> >and router. I tried to remove it manyally as per
>> directions at sarc.com, but
>> >the files listed on the site are not part of my
computer
>> and the registry
>> >files listed are not there either.
>> >
>> >All this and yet... I am still getting a
daily "lsass.exe
>> error - Invalid
>> >HANDLE" and my computer reboots at startup. The good
>> news is I am still able
>> >to eventually log on.
>> >
>> >Am I infected? and if so, what with????
>> >.
>> >
>>
>.
>

Jamik
Sat Aug 28 02:47:04 CDT 2004

> First of all, regarding SpyDoctor: it's a rogue/suspect
> anti-spyware product. Get rid of it A.S.A.P. and trust
> only the legitimate anti-spyware products that have a long
> and strong reputation like Ad-aware and Spybot Search &
> Destroy.

Thanks... removed

> Secondly, have you read through and followed all the
> things listed on the Web site I provided to you?

Yes

> Have you tried Symantec.com? (They are the makers of
> Norton Antivirus.) They have a Sasser removal tool; have
> you tried it? (Just do a Google search for "Symantec
> Sasser removal".) Unfortunately, I'm assuming you have
> tried that and it didn't work.

Been there, done that... was my first dead end.

> Microsoft has information on Sasser as well:
> http://www.microsoft.com/security/incident/sasser.mspx
> Have you read that, top to bottom, and followed the
> instructions there?

Just because, I went through this list again. Ran the sasser detect tool
that was on step 3 on the first page (step 8 under instructions for XP) Said
I was not infected with sasser. (as did the sasser tool downloaded from
symantec) I do not believe this means I am not infected.

I have been online and rebooting with no problems since 10 pm (2.5 hours
now) This is not unusual for the past few days with my system. Hopefully, I
have found or done something today that will fix it permanantly (although, I
have yet to figure out what really is the cause of my error)

> In the end, your suggestion of "wiping the system" is
> probably the last alternative to return your PC back to a
> desirable state.

I am not ready to do that just yet... I found in another link at a different
site that someone had this problem adn it magically stopped. Personally I
don't believe in magic

> Good luck!!!

Thanks for your help

anonymous
Sat Aug 28 11:02:16 CDT 2004

Well, Jamik, I can think up other scenarios on why this is
being so virulent, but in any case, you mentioned last
night that you found another link that might provide
a "magic" solution. Write back and let us know if that
worked so that you may share it with others.

By the way, have you posted in other forums that might
have been more useful? You haven't struck gold here or at
Symantec but there could be other places where the
solution is there for you.

Again, good luck; I know how frustrating this can be.

>-----Original Message-----
>> First of all, regarding SpyDoctor: it's a rogue/suspect
>> anti-spyware product. Get rid of it A.S.A.P. and trust
>> only the legitimate anti-spyware products that have a
long
>> and strong reputation like Ad-aware and Spybot Search &
>> Destroy.
>
>Thanks... removed
>
>> Secondly, have you read through and followed all the
>> things listed on the Web site I provided to you?
>
>Yes
>
>> Have you tried Symantec.com? (They are the makers of
>> Norton Antivirus.) They have a Sasser removal tool;
have
>> you tried it? (Just do a Google search for "Symantec
>> Sasser removal".) Unfortunately, I'm assuming you have
>> tried that and it didn't work.
>
>Been there, done that... was my first dead end.
>
>> Microsoft has information on Sasser as well:
>> http://www.microsoft.com/security/incident/sasser.mspx
>> Have you read that, top to bottom, and followed the
>> instructions there?
>
>Just because, I went through this list again. Ran the
sasser detect tool
>that was on step 3 on the first page (step 8 under
instructions for XP) Said
>I was not infected with sasser. (as did the sasser tool
downloaded from
>symantec) I do not believe this means I am not infected.
>
>I have been online and rebooting with no problems since
10 pm (2.5 hours
>now) This is not unusual for the past few days with my
system. Hopefully, I
>have found or done something today that will fix it
permanantly (although, I
>have yet to figure out what really is the cause of my
error)
>
>> In the end, your suggestion of "wiping the system" is
>> probably the last alternative to return your PC back to
a
>> desirable state.
>
>I am not ready to do that just yet... I found in another
link at a different
>site that someone had this problem adn it magically
stopped. Personally I
>don't believe in magic
>
>> Good luck!!!
>
>Thanks for your help
>.
>

Jamik
Sat Aug 28 14:03:10 CDT 2004

The "magic" solution I mentioned in the previous post unfortunatly had no
details about the problem. The system that was infected was windows 2003.
They did not mention any program they had attempted to use to remove this
either. hence the word "magic"

I have been using dogpile and google to search about this problem. Have not
had much luck. My brother is also a computer tech and I picked his brain
first.

Last question... Is it possible that the lsass.exe file may just be corrupt
without being attacked by a virus? If so, how would I restore that?

nutso
Sat Aug 28 19:23:11 CDT 2004

"Jamik"
> All this and yet... I am still getting a daily "lsass.exe error - Invalid
> HANDLE" and my computer reboots at startup. The good news is I am still
able
> to eventually log on.

So, you start your system, it boots, you see the error message, your
computer reboots, then you are able to log on? Does this only occur when you
start the computer after being turned off for a while? If so, what happens
if you insert a bootable diskette, start the system and let it run for a few
minutes, then remove the diskette and reboot?

Suggest you search Google newsgroups for

"lsass.exe error" "invalid handle"

nf

Jamik
Sat Aug 28 21:19:12 CDT 2004



> So, you start your system, it boots, you see the error message, your
> computer reboots, then you are able to log on?

Yes

>Does this only occur when you start the computer after being turned off for a >while?

Yes. Thank you... so far you are the first to understand what I am talking
about.

>If so, what happens if you insert a bootable diskette, start the system and let it run for a few minutes, then remove the diskette and reboot?

Don't know. I used to have bootable floppies before XP... since XP I do not
have a recovery disk or boot disk beacuse it is included with the XP CD (I
have that). How do I create a boot disk for xp (I can use another computer
to make a disk) and I will try that tomorrow morning.
> Suggest you search Google newsgroups for
>
> "lsass.exe error" "invalid handle"
>
> nf
>
>
>

nutso
Sun Aug 29 00:46:28 CDT 2004


"Jamik"
> Don't know. I used to have bootable floppies before XP... since XP I do
not
> have a recovery disk or boot disk beacuse it is included with the XP CD (I
> have that). How do I create a boot disk for xp

XP can create a bootable floppy from Windows Explorer. IIRC, just put a
diskette in drive A, right-click on A:, and select 'Format' with the
'system' box checked, like you'd do in Win98. The diskette will be a DOS
diskette and will not allow you to browse NTFS-formatted partitions. Doesn't
matter for this purpose, you just want to get the system warmed up before
the reboot.

You could also boot off the CD, but you might have to change your CMOS setup
to do so.

nf

Jamik
Sun Aug 29 14:43:15 CDT 2004

Well...

I booted from the windows XP cd, and chose the option to fix. This brought
me to an "old school" command prompt. I tried an old school solution CHKDSK.
After running this I was informed of bad sectors on my disk. Ran it again
with the /R option.

I turned off my computer for the night and this morning I did not encounter
my usual error.

My guess is that if it was not a virus, then this fised the problem. No way
to know for certain if the lsass.exe file was in a bad sector, but it would
explain why it worked sometimes and why it did not work other times.

I am online daily... I will post again in about a week about the progress of
this current fix.

Thanks for all your help.

nutso
Sun Aug 29 16:26:58 CDT 2004


"Jamik":
> My guess is that if it was not a virus, then this fised the problem. No
way
> to know for certain if the lsass.exe file was in a bad sector, but it
would
> explain why it worked sometimes and why it did not work other times.

Seemed like a good possibility. Hope it stays fixed. My experience is that
when sectors start going bad a HDD should be monitored closely as platter
defects can quickly spread.

nf

bob
Wed Aug 24 02:54:07 CDT 2005

Most people don't partition their harddrive because most people buy their
computer with the operating system already installed with Zero left of
unpartioned space on their harddrive.
Most people would say, why refomat a new computer?

I've never thought about repartioning, that's a great idea. I'll do that for
sure. Thanks for the info.

bob

"Victor X" <Victor.X.1u3e7l@mail.mcse.ms> wrote in message
news:Victor.X.1u3e7l@mail.mcse.ms...
>
> First things first;
> I just don't understand why all the people writing about booting errors
> have not gotten the real point yet! Most problems with booting and lost
> of data, in other words catastrophic computer failures, can be
> minimized, at least some what, using simple strategies like DISK
> PARTITIONING.
>
> I just don't understand what are you waiting to learn about disk
> partitioning?
>
> When an operating system is compromised, by what ever means (virus or
> file corruption), unless you have a secondary computer to access and
> extract your data, the most probable solution would be that of wiping
> clean and reinstalling the operating system and ALL the applications.
>
> If the Operating system and the applications resided in one disk and
> the data on another, this would prevent the lost of the data when the
> time comes to upgrade to a new operating system (be it Windows or
> migrating to Linux) or reinstallation to read our self of a malicious
> bug.
>
> Most users can't afford to have more than one hard disk installed, so
> partitioning your disk leaving a good size primary partition for the
> operating system of 5 or more GB, (given the size of the new disks this
> should not be a problem), and directing ALL their data to be stored on
> the secondary partition (and yes, consider that MOST programs can be
> directed as to their installation folder, even when placing them in a
> secondary partition may not be of much help when reinstalling them).
>
> Regarding Windows and the "My Documents" folder, especially in WinXP,
> you can instruct the system to move to a new folder on this second
> partition.
>
> You should take some time to identify where the programs you use store
> their data, and if at all possible redirect them to a new folder
> created specifically for them in the second partition.
>
> With regards to programs like Outlook you can enter in "Tools / Options
> / Maintenance" and move the location of your mail folder.
> I wish it would provide the same utility for the "Address Book" but in
> WinXp is located in the folder "My Documents"
>
> Do investigate about Partitioning and "My Documents" on Microsoft
> technical knowledge web site.
>
> Good luck.
>
>
> wrote:
> > *Sounds like Sasser to me. This site may prove to be
> > helpful:
> > http://ask-
> > leo.com/what_are_lsass_lsassexe_and_sasser_and_how_do_i_kno
> > w_if_im_infected_what_do_i_do_if_i_am.html
> >
> > To clear up the confusion as far as lsass.exe is
> > concerned: lsass.exe is legitimate and from Microsoft,
> > whereas isass.exe is a virus.
> >
> > Good luck.
> >
> >
> >
> >
> >
> > >-----Original Message-----
> > >OK, everyone tells me this is Sasser. Norton 2004 does
> > not fix it. All
> > >patches for windows have been downloaded. Norton is up
> > to date. Tried the
> > >removal tools for multiple worms including sasser. I am
> > behind a firewall
> > >and router. I tried to remove it manyally as per
> > directions at sarc.com, but
> > >the files listed on the site are not part of my computer
> > and the registry
> > >files listed are not there either.
> > >
> > >All this and yet... I am still getting a daily "lsass.exe
> > error - Invalid
> > >HANDLE" and my computer reboots at startup. The good
> > news is I am still able
> > >to eventually log on.
> > >
> > >Am I infected? and if so, what with????
> > >.
> > > *
>
>
>
> --
> Victor X
> ------------------------------------------------------------------------
> Posted via http://www.mcse.ms
> ------------------------------------------------------------------------
> View this thread: http://www.mcse.ms/message1001556.html
>