|
Home »
Windows
» Windows Configuration
Summary: Windows runs software when you log in, but if it can't be found, Windows reports an error. This can happen after an incomplete virus removal.
This question shows one of the very subtle ways that virus writers try to fool you. And there's no question, you have, or had, a virus. • Consider the following list of file names:
They all look similar, don't they? In fact, depending on your machine and installed fonts, some of them may look identical. But they are four very different file names (vertical bar - sass.exe, lower case "L" - sass.exe, lower case "I" - sass.exe, and the number one - sass.exe). One of these names is legitimate. "Fortunately, that's a relatively easy fix,
though it does require caution."
In fact, not only is it legitimate, but it's a required Windows component. Your system won't run without it. The rest? Malware. Malware trying to look like a required system file. My guess is that your anti-virus scan caught the malware at some point and removed the actual file in question. But what it didn't do is remove the registry entry that caused that file to be automatically run at start up. Fortunately, that's a relatively easy fix, though it does require caution. Grab a copy of the free autoruns utility from Microsoft. Fire it up and after it scans your system startup entries you'll see a screen much like this:
There are many places that Windows can be instructed to run software automatically, and autoruns attempts to display them all. Now, pay careful attention to exactly how the start up entry is spelled in that error message. I can't stress this enough - virus writers are counting on you to get this wrong, since getting it wrong can render your system unbootable. Press CTRL+F and enter the base name of what you're looking for. In the case of the question asked here, enter |sass.exe (that's a vertical bar followed by sass.exe). Press Find Next. If there's an auto-run entry that references that name (and by the error message you're getting, there is), autoruns will find it.
Dismiss the search box and press CTRL+D to delete the entry that it found. You might consider repeating the search just in case there's another reference. Reboot your system and your warning should be gone. Now, I don't have that virus on my system, so I'm going to show you what you should not delete:
This shows a reference in autoruns to the valid, legitimate and required "lsass.exe". There are several clues that this is the legitimate and proper file that should not be deleted:
Typically a virus attempt will at a minimum get the filename wrong, and if it gets the filename right it'll likely get the location wrong. Do not delete the entries referencing "%SYSTEMROOT%\system32\lsass.exe". But if the filename matches the error message you're seeing, and it's clearly not the "real" lsass, then delete or disable it to remove the warning. Or, if you're not sure and want to be extra cautious, consult your
local Windows computer geek. Related:
Article 12592 | Posted August 1, 2008 |
Popular & Hot How do I make a new MSN Hotmail account? How do I delete history items from my Google tool bar? My desktop Recycle Bin has disappeared - why, and how do I get it back? How do I delete my Hotmail account? I accidentally deleted my Recycle Bin in Vista - how do I get it back? New & Important How can I get the old Windows Live Hotmail back? Internet Safety: How do I keep my computer safe on the internet? Are free email services worth it? Would you please recover my password? My account has been hacked or I've forgotten it.
Stay Informed Archives Advertisers |
|||
•
welldone , thank you very much.
Posted by: Deyaa Addeen Fahmy Shedeed at August 6, 2008 01:10 AMI do not need to worry about the sass series but I find the autorun program useful.
Posted by: Ryan at August 7, 2008 04:04 PMGood article Leo
I struck this problem on 2 machines last month, and it took hours of googling to learn exactly what you have layed out above.
Posted by: anth11 at August 7, 2008 06:41 PMIn my case the problem was caused by the QQpass Trojan.
I saved one computer but had to wipe the other.
hi.i'm taking an error like this ..Windows cannot find 's' " error message on login..Looks like same this error ("Windows cannot find |sass.exe") but i cant find 's' folder anywhere..i cant find 's' via this programme(autoruns)..What can i do?
Posted by: Nuri at August 26, 2008 04:27 AM