Helping people with computers... one answer at a time.

Lsass.exe and svchost.exe are required system files for Windows NT, 2000 and XP. If you delete them without care your system may become unbootable.

Can I delete lsass.exe? svchost.exe?

If you're running Windows XP, 2000, 2003, or NT - Absolutely NOT.

These are required system files. Windows won't run without them. See these articles for more information:

Article C1962 - May 30, 2004 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

124 Comments
samer
June 20, 2004 7:42 AM

Hello i have windows 2000 im not a computer freak.

I took my PC for formatting sevral times but as soon as i connect to the internet SVCHOST.EXE appears and then i cant copy or paste or disconnect and other annoying stuff.
MY ANTI VIRUS IS UP TO DATE AND "STINGER" couldnt detect a virus it said that all my files are clean!
HELP!

Leo
June 20, 2004 9:52 AM

You're probably being infected or attacked as soon as you connect to the internet. You need to put a firewall of some sort in place before you connect. That's one of the steps outlined here: http://ask-leo.com/archives/000105.html

Drunk_ass
June 27, 2004 7:55 AM

When i start up my computer i get:
Couldnt open svchost.exe because dltime.dll could not be found

When i press ok button it reapears and when i press ok for 3 times its gone
This has had no influance on my daily computeruse but is just anoying on startup
Please post me an answer soon.
Thanks

Leo
June 27, 2004 9:25 AM

Don't know anything specific about that error. I'd probably have you run the system file checker, to start, and then a good spyware scanner.

bp
July 7, 2004 9:36 PM

When I'm running winmx and shut down my firewall (zonealarm 4.5) I get the windows screen indicating that lsass.exe has terminated and the system will shut down (w2k sp1 with all updates installed). My system scans as sasser-free and this error doesn't occur under any other circumstances, so I believe it's just due to the environment not the sasser virus. Can you confirm if other situations can cause the lsass to terminate (just plain old windows instability?)
Also, a second question - the sasser update doesn't install on w2k sp1, and they tech documents are careful to fail to mention it - is w2k sp1 not vulnerable to sasser, or is it wide open to sasser and the windows update wasn't built to protect sp1?

Leo
July 7, 2004 10:26 PM

Win2K SP4 (note, *4*) I believe has the patch as part of the SP. If you're back at SP1, then that's fairly old and wouldn't have the patch. LSASS can manifest as a result of several viruses. This article has more: http://ask-leo.com/archives/000114.html - bottom line is to get behind a firewall, and scan for viruses often.

Jat
July 8, 2004 3:37 AM

Hello There

When I boot up my computer which is running windows XP home edition, Just before it gets to the log on screen I get error message "Not enough Virtual Memory or paging file quota available to complete this operation". Then it reboots and does the same again. On the heading of the error message box it says Erroe - lsass.exe. I can not change VM because I can not get into windows (even in safe mode). I have important documents on there. What do I do???

suresh chandak
July 12, 2004 10:44 PM

Hi,
when i connect to internet ,my system givem me a warning "system will shut down in one minute" and then it starts the count down and finally get SHUT-DOWN .

what shall i do ? as this happens everytime i connect to internet .

Suresh CHandak

Leo
July 12, 2004 10:47 PM

Read the "What is LSASS" article referenced at the top of this page.

kahali
July 12, 2004 11:52 PM

send me your answer

Mohammad Raza
July 13, 2004 5:04 AM

I took my PC for formatting sevral times but as soon as i connect to the internet SVCHOST.EXE appears and then i cant copy or paste or disconnect and other annoying stuff.
MY ANTI VIRUS IS UP TO DATE AND "STINGER" couldnt detect a virus it said that all my files are clean!
HELP

Leo
July 13, 2004 9:00 AM

You're probably being infected or attacked as soon as you connect to the internet. You need to put a firewall of some sort in place before you connect. That's one of the steps outlined here: http://ask-leo.com/archives/000105.html

daveraj
July 14, 2004 5:49 AM

yes that same lsass file keeps shutting down my computer even though i had the virus i erridicated it yet that keeps bothering me i tried almost everything to get it out but wayy it's good

Saeed Ahmed
July 14, 2004 11:56 PM

i have problem in my computer have still erroe is accoured when i start or restart my cpu ( svchost.exe path is not found ) and norton is already quarntian this file please tell me what can i do for this viruse
saeed

Leo
July 15, 2004 8:56 AM

This article: http://ask-leo.com/archives/000105.html and this article http://ask-leo.com/archives/000253.html may help.

Batista
July 17, 2004 7:57 AM

go to msconfig console and in service tab unselect messenger. config ur update console and configure it any way u want and i think thats what i did when i had that problem. DONT OPEN ANY ATTACHED DOCUMENT EVEN DO U KNOW THE PERSON FIRST SCAN THEM FOR VIRUS.
I HOPE MY INF WAS HELPFULL

hadi
July 20, 2004 12:27 AM

heeeelp meeeeeeeeeeeeeeeee,

pleaseeeeeeeeee.

ogbola ayeni yinka
July 24, 2004 8:24 AM

whenever i turn on my server for the first time in the morning for about five minute its gives me a warning that it is going to shutdown it about one minute and after that i will click on run and type cmd and after that i type shutdown -a as i was directed by a website and nothing happen......I am using advanced server 2000....please help me about this.......

ogbola ayeni yinka
July 24, 2004 8:27 AM

my real I.p is having a serious problem after gotten a new I.P address...Anytime i commect it to the internet all other system will not browse..and will show cannot find server...I tried to connect it to net2phone will a router of two port...Please.....

Leo
July 24, 2004 9:45 AM

Ogbola: You need to read the two articles listed with this article. I can't tell from your description exactly what's failing when you try shutdown, but you may also need to grab a copy of "psshutdown" from http://sysinternals.com.

Leo
July 24, 2004 9:45 AM

On the IP question: I'm sorry, but I don't understand your question. Can you clarify?

omprakash
July 25, 2004 9:49 AM

whenever i turn on my computer that connected to internet for about five minute its gives me a warning(lsass.exe) that it is going to shutdown it about one minute and after that i will click on run and type shutdown -a as i was directed by a website and nothing happen......I am using windows xp professional....please help me about this.......

Leo
July 25, 2004 11:18 AM

Literally NOTHING happens, or do you get an error message? The difference is important.

farshid
July 30, 2004 12:31 PM

Dear Sir,
My Task Manager of Computer shows "Lsass.exe".
How can i remove it?
Thanks.

Jack Hickman
July 31, 2004 12:03 PM

How do I get my PC go to Windows?I get a lsass error that says---WHEN TRYING TO UP DATE A PASSWORD.THIE RETURN STATUS INDICATES THE VALUE IS PROVIDED AS THE CURRENT PASSWORD IS INCORRECT.
Thanks
Jack

Leo
August 2, 2004 9:25 AM

farshid: you don't. It's expected to see it there. Please read the article, and the related links.

Leo
August 2, 2004 9:33 AM

Jack: Check out the LSASS related article link that was included with this article.

Rachel
August 6, 2004 3:11 AM

can I delete the svchost.exe

Leo
August 6, 2004 9:42 AM

Please read the article at the top of the page.

Zohaib Siddiqi
September 2, 2004 1:15 PM

Dear All,

I am facing DOS attack problem n my LAN and my all PC broadcast the packets into the serial of real Ip continuesly.. how I protect our system

Dewald
November 3, 2004 5:59 AM

I did dlete all lsass entries inmy regedit on a windows 2000 server.......now what?
I get a messages exactly the same as teh sassler virus but nothing helps, my servers reboot everytime I start them up with the error of the lsass.exe

sandeep
November 19, 2004 12:18 AM


when i work on my pc having and internet connection through LAN, the message appears as "lsass.exe terminated" and the systems shuts down after a period of given seconds(maybe 60 secs). kindly please assist me with this problem

sandeep
November 19, 2004 12:20 AM

"C:\windows\system32\lsass.exe terminated unexpectedly with status code 128. Your computer will now shut down in __ seconds..."

This is the error I'm dealing with my pc connected to the internet through LAN, kindlly please help.

Leo
November 19, 2004 9:12 AM

You need the "What are LSASS ..." article that's linked to in the article at the top of this page.

Andrew
November 20, 2004 4:17 PM

man my computer runs slow and my internet takes a long time to open a site. Ive talked to ever1 on battle.net and they say its somethin to do with the ping but its not. then they tell me to open taskmgr and tell them the stuff i have. i said svchost.exe,Isass.exe,csrss.exe,smss.exe,alg.exe,spoolsv.exe,wuauclt.exe,ipmon32.exe,kbd.exe and they said if some of them take more cpu isage then explorer that they were either a spyware worm or any other kind of virus so plz help my pc used to be good and now it is horrible and i am sad. plz help

Andrew
November 20, 2004 4:19 PM

man my computer runs slow and my internet takes a long time to open a site. Ive talked to ever1 on battle.net and they say its somethin to do with the ping but its not. then they tell me to open taskmgr and tell them the stuff i have. i said svchost.exe,Isass.exe,csrss.exe,smss.exe,alg.exe,spoolsv.exe,wuauclt.exe,ipmon32.exe,kbd.exe and they said if some of them take more cpu isage then explorer that they were either a spyware worm or any other kind of virus so plz help my pc used to be good and now it is horrible and i am sad. plz help

shahen
November 29, 2004 7:34 AM

hi

shahen
November 29, 2004 7:55 AM

hi

Amanda
December 6, 2004 10:56 AM

I'm receiving the little counter that shuts down my computer in 60 seconds. I've tried everything possible to fix this problem from my computer. Do you have any solutions to fix this problem? I'm running windows 2000 on my computer. What can I do?

omar
January 18, 2005 2:09 PM

Hello!!........I keep running ad aware and my pc automatically shuts down......i checked for sasser virus but came out negative........could my pc have another virus

Leo
January 18, 2005 2:14 PM

Of course. Get a full anti-virus scanner, keep it up to date, and run it regularly. Recommendations here: http://ask-leo.com/d-recommend

Cher
February 3, 2005 9:45 AM

Thanks for all the great help here and the articles above. I know lsass.exe is infected (and there may be multiple viruses)

I'm running into a problem aborting the shutdown -a command on my Win 2000 SP1 infected machine.

The virus has disabled the shutdown command. I can't view the system32 or winnt folders (shows no files, even in explorer view). Can I run the shutdown -a command from the run dialog from a CD?

"D:\shutdown.exe -a" doesn't work.

I've run every virus software and spyware detector I can find, and nothing has cleaned the machine completely. I've hand edited much of the registry for obvious problem files I have (internat.exe, defragfatx.exe, macaddr.exe, winmedplay.exe, and a few others).

I am unable to install a software firewall, and I can't run Windows Update. Most name-brand detectors seem to be diabled or uninstallable or un-updateable (ZoneAlarm, McAfee, Norton won't work).


Any help is a big help :)

Leo
February 3, 2005 9:50 AM

Ya know... sometimes a system is so infected or messed up that the right thing to do is simply reinstall. From what you've described, that's exactly what I'd start with: a reinstall of the OS on top of your existing installation.

cher
February 3, 2005 12:11 PM

I did a repair, and that didn't work completely either. So, I think you're right. I was trying to avoid that at all costs in case any of the data was infected, as this is a business computer.

I do have another solution which I'll share (thanks to my techie bro's suggestion), in case I'm not the only one with this problem:

1. Take out the hard drive and install it on a known-clean machine with updated virus scanware as a slave drive.
2. Do not access the drive when you boot the other machine
3. Do a virus and spyware scan (or three or four) on the slave drive
4. Reinstall the drive

Cher

James77
April 13, 2005 2:33 PM

When does the Q get answer'd anyway ? lsass.exe is a bitch i want rid too .I have deleted other viruses but this is messed , how is it done ?

Leo
April 13, 2005 2:42 PM

The question is answered in the article. You do not delete lsass.exe.

Garry Campbell
June 23, 2005 1:05 AM

I have mistakenly deleted svchost.exe and svc.dll's how do i re-install them

Leo
June 23, 2005 9:43 AM

The safest is to reinstall Windows.

jamshed
June 25, 2005 9:23 AM

i want to delete lsass

shabi
June 27, 2005 2:54 AM

i tryed to delet the file but i couldnt.
it told me that it is being used and i couldnt shutdown the file but i couldnt.
plz help me i dont know what to do when i do format to my computer i have this problems all the time i dont know what to do anymore plz help me i need help.

BG69
June 27, 2005 4:54 AM

If lsass.exe is anywhere but C:\windows\system32 Delete it.........

Manish
June 27, 2005 5:50 AM

My PC was getting restarted bcoz of lssas.exe
It says system will shutdown and countdowns for the timings. then I formatted my Pc then also i m facing the same problem. What to do sir???

Manish
June 27, 2005 5:52 AM

My PC was getting restarted bcoz of lssas.exe
It says system will shutdown and countdowns for the timings. then I formatted my Pc then also i m facing the same problem. What to do sir???

shabi
June 28, 2005 9:08 AM

i did format again and i have the same problem.
it happens only when i go online the internet.
today it happend and i formated yesterday only, and it happend only when i got off the firewall.
plz help me i dont know what to do im hopeless...:(

Leo
June 30, 2005 9:39 AM

You need to get (and stay) behind a firewall. This article has more: http://ask-leo.com/what_are_lsass_lsassexe_and_sasser_and_how_do_i_know_if_im_infected_what_do_i_do_if_i_am.html

sid
July 11, 2005 7:54 AM

plz tel le how to tackle this lsass.exe problem with window xp?window shut down in 60minutes.reply soon

sid
July 11, 2005 8:05 AM

how can i tackle lsass.exe problem.tel me in detail

Leo
July 11, 2005 8:41 PM

Check out the links in the article you just commented on.

David D
July 24, 2005 12:21 PM

Leo,

Do you know what the fix for this is: I have XP-P. My Internet Explorer home page and desktop have been hijacked. Uniquely, the same invader opens my CD drawer every few minutes and throws up a sign saying I urgently need their security system because I have "evidence" in my computer. If I put a CD in my drawer, the pc no longer recognizes it, the screen that should show that drive as opening on command is blank. If I put my CD into the second drawer, which does not open by itself mysteriously, the pc says I do not have a disc in it. This has made it impossible to back up my files for a re-format.

Nortons 2005 SystemWorks and Nortons firewall has done no good, obviously. AdAware SE has found some objects in my registry but evidently cannot get rid of either them (although it claims to have at the time of scan) or whatever this intruder is.

Since I cannot find a name for it, I cannot proceed in any way other than to get an expensive re-formatting.

Hellp!!

Thank you.

Leo
July 24, 2005 4:27 PM

I would try another scanner. Microsoft's Anti-Spyware program is my recommendation, but there are others: http://ask-leo.com/recommendation_microsoft_antispyware.html

I am an idiot
October 14, 2005 3:56 PM

I accidently deleted lsass.exe, how the !@#$ do I get it back?

Please help, I dont want my comp screwed forever.

alan
November 23, 2005 6:57 AM

run stinger it will remove the sasser/blaster
virus run sfc /scannow from the start run cmd
if you have your xp cd try a repair to replace file after cleaning the virus

Ali
December 4, 2005 9:34 AM

I have 6 windows task manger processes. isas.exe, spools.exe, msmgs.exe, taskmgi.exe, csrss.exe, svchost.exe. All of witch need to be deleted but i have no idear how to do the without messing up my system! could anyone help me?

Leo A. Notenboom
December 4, 2005 9:41 AM

Why do you say thel need to be deleted? Very likely that your system WILL NOT RUN WITHOUT THEM.

What problem are you really trying to solve?

sushil
December 15, 2005 3:55 AM

can i delete isass.exe

Leo
December 15, 2005 10:10 PM

If you typed it properly, yes. isass.exe is a virus. You should run a virus scan.

IGI
December 20, 2005 1:18 AM

HI i am trying to delete isass.exe from my task mgr and from the whole system how could i do that i ran a virus scan it doesnt work, i deleted some some trojans or virus but that one is not letting me anyone know how, thanks..

tony
December 27, 2005 11:35 PM

Hello:

I have found the lsass.exe in my strtup menu today and can not uncheck it or get rid of it. I have scanned with my updated Antivir antivirus and virus detected. the file started today and it is in C:\windows\lsass.exe and not in system files. Also it is in HKCU\software\microsoft\windows\xurrentversion\run. in regedit says localauthority service in the HKCU. I have checked its properties and it says microsoft file and on the registry. I have checked it and all indications seems its a real window file but I do not know what to do? I appreciat any help. I think I may havegot it whan I downladed two new antispyware such as xsoft and pc spyware and adware remover. I have uninstalled these programs but it is still there.

I-Love-My-CPU :)
January 3, 2006 1:00 PM

Get to know your computer better! :)

As stated earlier, isass.exe can posibly be a virus, so run a full virus before you do this. Also run Ad-Aware (make sure you update these programs). I don't recommend "Microsoft Anti-spyware program (as Leo does above {not the real Leo}) as it is still in beta and loads more processes than it stops. By the way, by all means Keep "Xoft Spy Remover" (one of the best, "Spyware Blaster" is another very good one)!

ONCE YOU'VE DETERMINED NO VIRUS OR SPYWARE IS ON YOUR SYSTEM, PROCEED AS FOLLOWS!

Open = "Control Panel" =next= Open = "Adminstrative Settings"!
Now click on "Services"! Here you find all the services that are visable in your process manager.

THESE ARE THE PROGRAMS NAMED ABOVE YOU NEED TO LEAVE ALONE!
=lsass.exe (essential)=
=spools.exe (if you use a printer)=
=svchost.exe (maybe two of these with no problems=
=taskmgi.exe (is the window u r looking at: Task Manager)=
=csrss.exe (essential)=

IF YOU DID THE VIRUS SCAN!
=isas.exe (will be gone)=
=msmgs.exe "Messenger"(of no use to normal user and is often used to spam you with Official looking Windows Popups. This is a very simple network messenger not same as an online Messenger Program.
In the "Adminstrative Settings>>Services" you can right click/menu and choose properties. Click on the dropdown box next to it, Choose "Disabled"! If the process is running you can stop it here as well.

If you want to experiment with other processes then first look at the icons in the "Services" page. You will see one on =mouse over= called "Export List". Here you can save a list of the setup you have before you start tinkering. Preferribly get a screenshot of the "Services" page. This could save you if you make a mistake. But the saved screenshot will be much easier to decipher later. ;)

Best bet, before you make any permanent changes is to just stop a process for awhile and then use your computer. See if everything runs all right. If it continues to run fine doing everything you normally do, then you know you can "Disable" it. But write the ones down you disable on paper just in case.

Oh yes do have a "Firewall" installed and running. I recommend "Sysgate Personal Firewall"! It was recently bought by "Symantec" (Norton), but is still free and still better than their pay for one. ;)

jay
January 5, 2006 1:56 AM

how do i delete the Isass.exe file from my computer.. because it destroy all my application..?

Shalindar
January 14, 2006 2:18 AM

hey why do you say I need to leave svchost? I once had something from the internet which slowed down my comp(very badly) called istsvc. I managed to remove it with task manager. now I have this svchost, I have 7 of them and they slow down my comp too(not that much as istsvc). From what I know they are bad and need to be removed. I don't care if those things are not viruses or malware or they will mess up my computer, I just want to remove them. Please tell me how. I'm pretty sure that when I reinstalled windows I never had these things

Leo A. Notenboom
January 14, 2006 4:40 PM

I really don't know how to make it any clearer that the article at the top of the page: svchost.exe (in the system32 directory) is part of windows. svchost is required. If you delete svchost Windows will not work.

See also http://ask-leo.com/what_is_svchost_and_why_is_there_more_than_one_copy_running.html

Wisass
January 23, 2006 3:04 PM

Leo please explain the difference between Svhost and Svchost.exe the difference is a c and it a system file imitator like isass.exe is from Lsass.exe and most probably is a virus however i can freakin remove isass.exe i contained it with my firwall its not a Sasser coz neither Norton Anitivir Panda Titanium or Pc Cillen trend micro or all the (pay me im top on the list AV junk)doesnt sees it as a virus
I got 2 process isass.exe(c:\Windows\isass.exe)(virus) and Lsass.exe(C:\windows\system32)(MS authen contoll whatever)now how to remove?!!!

sibulelo.bavuma
February 1, 2006 4:19 AM


Thanks for responding to me but I still need an answer for my question, may be you have not heard my question. My question is how can I remove some from google search? If you can tell me the intructions to follow or to perform.

Leo
February 1, 2006 10:03 AM

You mean from google search *results*? That's this article: http://ask-leo.com/how_do_i_remove_myself_from_the_search_engines.html

Joe
February 9, 2006 3:34 PM

I'm having an issue with isass.exe, lsass.exe, isass.pf and isass.pf. I ran my Antivirus and it popped up as lsass.exe is an infected file, and it wont clean, delete or even quarentine. How the hell do i get rid of this annoying little pest?

mouhammed
March 3, 2006 7:57 AM

I want to remove the lsassexe file can you help me

Leo
March 3, 2006 9:17 AM

Don't do it. Read the article.

abro
April 15, 2006 9:55 AM

my system is suffuring from lsass.exe I want to remove lsass.exe for ever please help me how can i remove this voirus for ever

Virus-Hater
April 15, 2006 10:10 AM

I see 6 or 7 svchost things running in my task manager. I assume they are needed so I will not touch it. I also see lsass, but after all I read, it must be needed. But what is winlogon.exe, spoolsv.exe, or services32.exe...I ave noticed when i do scans with Adaware and HijackThis that alot of services32, system32, and win32 things come up? What is wrong with my computer?? I keep getting pop-ups.

ashish
April 24, 2006 9:53 PM

i got the file named as Isass..exe..iam wondering is this s virus or any harm full content like that for my pc

Leo
April 24, 2006 10:08 PM

Isass.exe is probably a virus. Get a good virus scanner, make sure its database is up to date, and scan to repair.

Sam
May 1, 2006 4:25 AM

is there any special program to remove svhost virus?

Keith
May 8, 2006 11:54 PM

you cannot delete the Lsass.exe , you can install the patch .If you delete it your pc won't work .

Furqan Hameed
May 10, 2006 2:25 AM

I am facing the problem of svchost.exe. Please guide me?

Thanx

Evangelism
May 17, 2006 10:10 PM

but Isass.exe is a trojan in windows XP home edition and also service.exe therfore do i delete this 2 trojans and if yes, HOW?

Leo
May 17, 2006 10:19 PM

Using a good Anti-Virus program

Evangelism
May 17, 2006 10:30 PM

recommendations? for a gd antivirus program?

Evangelism
May 17, 2006 10:33 PM

anyway,i have reformat my com but this 2 trojans kept appearing...are this 2 trojans considered to have keyloggers in it?

Leo
May 17, 2006 10:38 PM

http://ask-leo.com/viruses_how_do_i_keep_myself_safe_from_viruses.html has several AV program recommendations.

Lisa
June 4, 2006 8:20 PM

You can delete a virus by starting up in safemode. Then perform a search for the executable file. Find it and trash it immediately. You can only delete a virus in safemode, otherwise, if i you are using your OS in regular, the system will know its being used and wont delete it.

Lisa
June 4, 2006 8:29 PM

Anti-virus programs dont really do jack. pardon my jargon. I performed system scans for spyware and viruses, came out clean, but i still saw the spyware in my taskmanager and the scans read as clean. It is bull.

john
June 10, 2006 10:01 PM

where do i get this patch?

gabriel
August 12, 2006 7:26 PM

error and my archive appcompat.txt help me please

gabriel
August 12, 2006 7:27 PM

i my svchost.exe.mdmp and

svchost.exe.hdmp
help me

haha!
September 22, 2006 5:36 PM

lssas is not a virus but sasser infects the exe.

a good antivirus would be bit defender...

Penny
October 16, 2006 5:11 AM

I was disabling some programs in msconfig and must have done the Isass.exe....my computer will not bootup up...it gets to the windows xp emblem and then goes black with the Isass.exe-error message. How do can I get passed it to enable the program?

Anthony Landon
December 18, 2006 3:38 PM

i have at least 6 svhost.exe on my computer and the Isass.exe program, i cannot delete them, i triee running my anti-virus scan and it said there is nothing wrong, my coputer is getting really slow. can someone tell me how to get rid of it?

Wal-Mart
December 24, 2006 10:42 PM

Try using regmechanic to make your computer faster, if that doesn't work, try looking for other processes that are disrupting your computer. I currently have 6 svchost.exe running, or more, and my computer is fine. I also recommend computer cleaners, like "CCleaner or Webroot Window Washer."

shayan
December 25, 2006 7:34 AM

my anti virus keeps on telling me that svchost.exe is a virus but i cannot delete it plz tell me how 2 delete it

ed
January 27, 2007 7:32 AM

double check whether you are dealing with svchost or svhost...it is kind of important.

Badal
February 2, 2007 8:38 AM

my pc has a virus thats name is svchost, that i cant delete. how i can remove it plzzzzzzzz help me.

Badal
February 2, 2007 8:42 AM

my pc has a big virus thats name is svchost.exe. thats are not deleting. how i can remove it plz help me

Type_name_here
February 16, 2007 11:55 PM

svchosts are not always bad they are sometimes used by prog's by windows to operate, just because you have a lot o f them doesn't mean that you have a bunch of viruseses. :-P

mohan
February 27, 2007 1:17 PM

Can I delete lsass.exe? svchost.exe? my system etting slow its a sevior headache for me help me pleese

Leo Notenboom
February 27, 2007 1:34 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Please read the article you just commented on.

Leo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)

iD8DBQFF5KPiCMEe9B/8oqERAusKAJ4rHGPPKke7+nT4c9WQZ4l/TiLQsQCfdACg
p7c965dTvwarGQmIAoFNlUM=
=Xwnf
-----END PGP SIGNATURE-----

Stephen
March 21, 2007 6:31 AM

I have the same problem svchost.exe right off of start up is running and nothing else will run
till I bring up task manager end task then I can start running programs again. but then later on iexplorer will run but evertime I close it an about/blank will pop up

pkp
April 6, 2007 10:33 AM

i have deleted the lsass.exe in my system while using the anti virus. Still it is very slow and svchost.exe also present in my system. plz suggest me how to rectify this problem.

Nameless
May 11, 2007 4:34 AM

Please, do not even try to delete your svchost.exe-file. Doing that might destroy your system (not physically). It's the main process, which opens other processes when you start your system. The scvchost.exe-file is infected if it causes viruses. It should be replaced with a clean one, which could be done by reinstalling your operating system. There might also be a program that could repair the file. Blocking the svchost.exe isn't good either and if you attempt to stop it from the task manager it will send a pop-up with a timer. Then the countdown begins and the system will close in 60 seconds.

S. Mpata
May 25, 2007 7:35 AM

I moved svchost.exe to the recycle bin. Now my system is not working properly, for instance I can't copy&paste or run a search. What do I do? Please help!!!!

Joao Paulo
November 3, 2007 4:37 AM

Do not remove lsass.exe and svchost.exe!! these isn't virus!! it must be infected by a virus!! if you exclude this files the system will not work right!! try to heal the file with an antivirus or replace with a clean file!!

siby
November 7, 2007 5:17 AM

I had a virus in my computer. I instalalled a new virus scan nod32 which detected the virus and deleted a lot of them, togather with this i guess it deleted SVCHOST.EXE. NOw when I startup my compute. I get a message stating svchost.exe not detected.
I can't open my taskmanager also, which probably could be because of this.
I would like to know how can I Install an svchost.exe from and how can I get My task manager functiong

aubrey david
February 26, 2008 1:53 AM

i cant seem to shut down my computer the usual way..instead i am required to open my task manager every time, end task ISASS. exe before i could turn it off... i believe it is infected by a virus or something...how can i resolve this?..please help.

Rajesh
June 6, 2008 2:43 AM

Hi Leo, I have deleted lsass.exe & smss.exe after my laptop infected with Funny IST scandal from the registry. I was not aware that these are windows files and essential for system to run. Now I am not able to boot my laptop, is there any solution for this?

Thanks in advance.
Rajesh.

Leo
June 6, 2008 9:27 AM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You'll probably have to perform a repair-reinstall of
Windows.
http://ask-leo.com/how_should_i_reinstall_windows.html

Leo


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFISWVdCMEe9B/8oqERAqAHAJ0WP2AWyZ6FhBXO99IKaVElTiPv+ACgh5yD
07Y3OgPfx3SDoqALQz0EQCE=
=YMZP
-----END PGP SIGNATURE-----

Jimmy Wong
August 23, 2008 12:31 AM

I'm confused, got a alert from norton internet security, indication low risk, so what to do block or grant access to the internet for lsass.exe, pls help. Thanks all for the comments.

Trina
November 20, 2008 11:59 PM

Uh, Yeah, I kind of sent svchost to the recycle and screwed up my computer.
I connected my stuffedup harddisk as a slave and was able to copy paste a svchost.exe file into windows32 but i cant seem to activate it.
I really want my files back!!
Everythings due at school now so acessing files is kind of crucial!
PLEASE HELP LEO!!!!!

Trina
November 21, 2008 12:14 AM

K, Leo,
I've just read some more posts and im saddened to find out the SAFEST THING to do is reload windows. . . are there any LESS SAFE options that allow me to still keep my files?
PLEASE HELP LEO!!!

Trina
November 21, 2008 12:24 AM

Sorry Here is my predicament saidmore clearly.
I deleted svchost.exe
I found a copy of svchost.exe
I put it in the windows32 file
My computer sees it and says theres an error (sorry dunno what it is right now)
Is there a way of properly activating it or fixing it.
I wouldlike to avoid reloading windows.
PLEASE HELP (Hope this was clearer)

Vince
April 1, 2009 6:29 PM

hi Leo, can you help me w/ my problem of SVCHOST.EXE that is eating up my memory/cpu usage.. i'm using windows xp sp2,can i have a step by step manual correction for this matter...
thanks!

mike
May 9, 2009 2:43 PM

Hello

My svchost.exe i guess it is infected
because each time i upload a file to my hosting, it looks fine, but after a while , i see a java script line added to my index page and this is malaware . in google my sites started showing that it this site might harm your pc.
i made format to my pc, and again i was attacked by the same problem,

I tried 4 different hosting companies, they said that someone has access to my passwords to do that, i changed password and still same problem.

i was reading http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/

so how to deal with that?
thanks

Frank Rojer
May 18, 2009 8:29 PM

I have three or more entries of svchost.exe in TasK Manager.
When I end the svchost process with the highest CPU-time
after som time i get the message that a shutdown is coming.
For that I am prepared in cmd to abort that shutdown.
Is this a virus.

I have a screenshot of task manager but I do not know how to send it to you.
Zone Alarm detected 55 attempts to go outbound.

Before that I had 1175 viruses all of them with names of
movies.
I removed them with a trial of Avira Pro.
I am using Virtual PC on a Mac G4 (QuickSilver) 2 processors
and 1.5 Gb core.

Have a nice day!!

Theunis
April 25, 2012 6:02 AM

Why does lsass.exe happily "export" data from my computer without my consent or knowledge ?. I observed this when I recently installed PC Tools Firewall Plus. Chunks of outgoing data was been recorded which originated from this program. Over 2 Mbytes had already been recorded as outgoing and about 1.5M as incoming by this exe.
I have now used PC Tools Firewall Plus to completely block it and Nothing is now being "exported" nor received. Windows does not appear to have any problems with it being blocked from accessing the Internet.
I was always wondering where the extra use of my bandwith was coming from and it now appears that I have found the culprit.
SvcHost as far as I can see is essential but it shows no abnormal activity.
So what is lsass.exe really is it Microsoft Spyware?
What is it's function ?

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.