LSASSER.EXE errors are not always the Sasser worm/virus. It may be something you least expect.

Yesterday, I worked on a computer for a client that had previously been told by a Dell customer service representative that based on the error he reported, his computer had contracted the Sasser worm\virus. The customer didn’t buy the explanation;but, here is the error that lead to the diagnosis:

LSASS.EXE: System Error
Endpoint Format is Invalid

Hmmm…well I can definitely see why the representative would say, “Sasser!” If you were in the know during 2004, the Sasser infection displayed a similar message dealing with the lsasser.exe.

The technician failed to observe at least one symptom…the computer would not boot completely.

The Sasser worm wants the computer to boot because it wants to propagate itself to other computers over the internet.

The real problem, in my customers case, was that the file resources for the lsass.exe process were damaged because of bad blocks on the hard drive. The hard drive failure was detected by doing three tests: confidence, read and verify. All three tests failed with bad blocks detected.

Olan Butler
Kansas City Computer Repair