Helping people with computers... one answer at a time.

Lsass.exe and svchost.exe are required system files for Windows NT, 2000 and XP. If you delete them without care your system may become unbootable.

Can I delete lsass.exe? svchost.exe?

If you're running Windows XP, 2000, 2003, or NT - Absolutely NOT.

These are required system files. Windows won't run without them. See these articles for more information:

Article C1962 - May 30, 2004 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

June 20, 2004 7:42 AM

Hello i have windows 2000 im not a computer freak.

I took my PC for formatting sevral times but as soon as i connect to the internet SVCHOST.EXE appears and then i cant copy or paste or disconnect and other annoying stuff.
MY ANTI VIRUS IS UP TO DATE AND "STINGER" couldnt detect a virus it said that all my files are clean!

June 20, 2004 9:52 AM

You're probably being infected or attacked as soon as you connect to the internet. You need to put a firewall of some sort in place before you connect. That's one of the steps outlined here:

June 27, 2004 7:55 AM

When i start up my computer i get:
Couldnt open svchost.exe because dltime.dll could not be found

When i press ok button it reapears and when i press ok for 3 times its gone
This has had no influance on my daily computeruse but is just anoying on startup
Please post me an answer soon.

June 27, 2004 9:25 AM

Don't know anything specific about that error. I'd probably have you run the system file checker, to start, and then a good spyware scanner.

July 7, 2004 9:36 PM

When I'm running winmx and shut down my firewall (zonealarm 4.5) I get the windows screen indicating that lsass.exe has terminated and the system will shut down (w2k sp1 with all updates installed). My system scans as sasser-free and this error doesn't occur under any other circumstances, so I believe it's just due to the environment not the sasser virus. Can you confirm if other situations can cause the lsass to terminate (just plain old windows instability?)
Also, a second question - the sasser update doesn't install on w2k sp1, and they tech documents are careful to fail to mention it - is w2k sp1 not vulnerable to sasser, or is it wide open to sasser and the windows update wasn't built to protect sp1?

July 7, 2004 10:26 PM

Win2K SP4 (note, *4*) I believe has the patch as part of the SP. If you're back at SP1, then that's fairly old and wouldn't have the patch. LSASS can manifest as a result of several viruses. This article has more: - bottom line is to get behind a firewall, and scan for viruses often.

July 8, 2004 3:37 AM

Hello There

When I boot up my computer which is running windows XP home edition, Just before it gets to the log on screen I get error message "Not enough Virtual Memory or paging file quota available to complete this operation". Then it reboots and does the same again. On the heading of the error message box it says Erroe - lsass.exe. I can not change VM because I can not get into windows (even in safe mode). I have important documents on there. What do I do???

suresh chandak
July 12, 2004 10:44 PM

when i connect to internet ,my system givem me a warning "system will shut down in one minute" and then it starts the count down and finally get SHUT-DOWN .

what shall i do ? as this happens everytime i connect to internet .

Suresh CHandak

July 12, 2004 10:47 PM

Read the "What is LSASS" article referenced at the top of this page.

July 12, 2004 11:52 PM

send me your answer

Mohammad Raza
July 13, 2004 5:04 AM

I took my PC for formatting sevral times but as soon as i connect to the internet SVCHOST.EXE appears and then i cant copy or paste or disconnect and other annoying stuff.
MY ANTI VIRUS IS UP TO DATE AND "STINGER" couldnt detect a virus it said that all my files are clean!

July 13, 2004 9:00 AM

You're probably being infected or attacked as soon as you connect to the internet. You need to put a firewall of some sort in place before you connect. That's one of the steps outlined here:

July 14, 2004 5:49 AM

yes that same lsass file keeps shutting down my computer even though i had the virus i erridicated it yet that keeps bothering me i tried almost everything to get it out but wayy it's good

Saeed Ahmed
July 14, 2004 11:56 PM

i have problem in my computer have still erroe is accoured when i start or restart my cpu ( svchost.exe path is not found ) and norton is already quarntian this file please tell me what can i do for this viruse

July 15, 2004 8:56 AM

This article: and this article may help.

July 17, 2004 7:57 AM

go to msconfig console and in service tab unselect messenger. config ur update console and configure it any way u want and i think thats what i did when i had that problem. DONT OPEN ANY ATTACHED DOCUMENT EVEN DO U KNOW THE PERSON FIRST SCAN THEM FOR VIRUS.

July 20, 2004 12:27 AM

heeeelp meeeeeeeeeeeeeeeee,


ogbola ayeni yinka
July 24, 2004 8:24 AM

whenever i turn on my server for the first time in the morning for about five minute its gives me a warning that it is going to shutdown it about one minute and after that i will click on run and type cmd and after that i type shutdown -a as i was directed by a website and nothing happen......I am using advanced server 2000....please help me about this.......

ogbola ayeni yinka
July 24, 2004 8:27 AM

my real I.p is having a serious problem after gotten a new I.P address...Anytime i commect it to the internet all other system will not browse..and will show cannot find server...I tried to connect it to net2phone will a router of two port...Please.....

July 24, 2004 9:45 AM

Ogbola: You need to read the two articles listed with this article. I can't tell from your description exactly what's failing when you try shutdown, but you may also need to grab a copy of "psshutdown" from

July 24, 2004 9:45 AM

On the IP question: I'm sorry, but I don't understand your question. Can you clarify?

July 25, 2004 9:49 AM

whenever i turn on my computer that connected to internet for about five minute its gives me a warning(lsass.exe) that it is going to shutdown it about one minute and after that i will click on run and type shutdown -a as i was directed by a website and nothing happen......I am using windows xp professional....please help me about this.......

July 25, 2004 11:18 AM

Literally NOTHING happens, or do you get an error message? The difference is important.

July 30, 2004 12:31 PM

Dear Sir,
My Task Manager of Computer shows "Lsass.exe".
How can i remove it?

Jack Hickman
July 31, 2004 12:03 PM


August 2, 2004 9:25 AM

farshid: you don't. It's expected to see it there. Please read the article, and the related links.

August 2, 2004 9:33 AM

Jack: Check out the LSASS related article link that was included with this article.

August 6, 2004 3:11 AM

can I delete the svchost.exe

August 6, 2004 9:42 AM

Please read the article at the top of the page.

Zohaib Siddiqi
September 2, 2004 1:15 PM

Dear All,

I am facing DOS attack problem n my LAN and my all PC broadcast the packets into the serial of real Ip continuesly.. how I protect our system

November 3, 2004 5:59 AM

I did dlete all lsass entries inmy regedit on a windows 2000 what?
I get a messages exactly the same as teh sassler virus but nothing helps, my servers reboot everytime I start them up with the error of the lsass.exe

November 19, 2004 12:18 AM

when i work on my pc having and internet connection through LAN, the message appears as "lsass.exe terminated" and the systems shuts down after a period of given seconds(maybe 60 secs). kindly please assist me with this problem

November 19, 2004 12:20 AM

"C:\windows\system32\lsass.exe terminated unexpectedly with status code 128. Your computer will now shut down in __ seconds..."

This is the error I'm dealing with my pc connected to the internet through LAN, kindlly please help.

November 19, 2004 9:12 AM

You need the "What are LSASS ..." article that's linked to in the article at the top of this page.

November 20, 2004 4:17 PM

man my computer runs slow and my internet takes a long time to open a site. Ive talked to ever1 on and they say its somethin to do with the ping but its not. then they tell me to open taskmgr and tell them the stuff i have. i said svchost.exe,Isass.exe,csrss.exe,smss.exe,alg.exe,spoolsv.exe,wuauclt.exe,ipmon32.exe,kbd.exe and they said if some of them take more cpu isage then explorer that they were either a spyware worm or any other kind of virus so plz help my pc used to be good and now it is horrible and i am sad. plz help

November 20, 2004 4:19 PM

man my computer runs slow and my internet takes a long time to open a site. Ive talked to ever1 on and they say its somethin to do with the ping but its not. then they tell me to open taskmgr and tell them the stuff i have. i said svchost.exe,Isass.exe,csrss.exe,smss.exe,alg.exe,spoolsv.exe,wuauclt.exe,ipmon32.exe,kbd.exe and they said if some of them take more cpu isage then explorer that they were either a spyware worm or any other kind of virus so plz help my pc used to be good and now it is horrible and i am sad. plz help

November 29, 2004 7:34 AM


November 29, 2004 7:55 AM


December 6, 2004 10:56 AM

I'm receiving the little counter that shuts down my computer in 60 seconds. I've tried everything possible to fix this problem from my computer. Do you have any solutions to fix this problem? I'm running windows 2000 on my computer. What can I do?

January 18, 2005 2:09 PM

Hello!!........I keep running ad aware and my pc automatically shuts down......i checked for sasser virus but came out negative........could my pc have another virus

January 18, 2005 2:14 PM

Of course. Get a full anti-virus scanner, keep it up to date, and run it regularly. Recommendations here:

February 3, 2005 9:45 AM

Thanks for all the great help here and the articles above. I know lsass.exe is infected (and there may be multiple viruses)

I'm running into a problem aborting the shutdown -a command on my Win 2000 SP1 infected machine.

The virus has disabled the shutdown command. I can't view the system32 or winnt folders (shows no files, even in explorer view). Can I run the shutdown -a command from the run dialog from a CD?

"D:\shutdown.exe -a" doesn't work.

I've run every virus software and spyware detector I can find, and nothing has cleaned the machine completely. I've hand edited much of the registry for obvious problem files I have (internat.exe, defragfatx.exe, macaddr.exe, winmedplay.exe, and a few others).

I am unable to install a software firewall, and I can't run Windows Update. Most name-brand detectors seem to be diabled or uninstallable or un-updateable (ZoneAlarm, McAfee, Norton won't work).

Any help is a big help :)

February 3, 2005 9:50 AM

Ya know... sometimes a system is so infected or messed up that the right thing to do is simply reinstall. From what you've described, that's exactly what I'd start with: a reinstall of the OS on top of your existing installation.

February 3, 2005 12:11 PM

I did a repair, and that didn't work completely either. So, I think you're right. I was trying to avoid that at all costs in case any of the data was infected, as this is a business computer.

I do have another solution which I'll share (thanks to my techie bro's suggestion), in case I'm not the only one with this problem:

1. Take out the hard drive and install it on a known-clean machine with updated virus scanware as a slave drive.
2. Do not access the drive when you boot the other machine
3. Do a virus and spyware scan (or three or four) on the slave drive
4. Reinstall the drive


April 13, 2005 2:33 PM

When does the Q get answer'd anyway ? lsass.exe is a bitch i want rid too .I have deleted other viruses but this is messed , how is it done ?

April 13, 2005 2:42 PM

The question is answered in the article. You do not delete lsass.exe.

Garry Campbell
June 23, 2005 1:05 AM

I have mistakenly deleted svchost.exe and svc.dll's how do i re-install them

June 23, 2005 9:43 AM

The safest is to reinstall Windows.

June 25, 2005 9:23 AM

i want to delete lsass

June 27, 2005 2:54 AM

i tryed to delet the file but i couldnt.
it told me that it is being used and i couldnt shutdown the file but i couldnt.
plz help me i dont know what to do when i do format to my computer i have this problems all the time i dont know what to do anymore plz help me i need help.

June 27, 2005 4:54 AM

If lsass.exe is anywhere but C:\windows\system32 Delete it.........

June 27, 2005 5:50 AM

My PC was getting restarted bcoz of lssas.exe
It says system will shutdown and countdowns for the timings. then I formatted my Pc then also i m facing the same problem. What to do sir???

June 27, 2005 5:52 AM

My PC was getting restarted bcoz of lssas.exe
It says system will shutdown and countdowns for the timings. then I formatted my Pc then also i m facing the same problem. What to do sir???

June 28, 2005 9:08 AM

i did format again and i have the same problem.
it happens only when i go online the internet.
today it happend and i formated yesterday only, and it happend only when i got off the firewall.
plz help me i dont know what to do im hopeless...:(

June 30, 2005 9:39 AM

You need to get (and stay) behind a firewall. This article has more:

July 11, 2005 7:54 AM

plz tel le how to tackle this lsass.exe problem with window xp?window shut down in 60minutes.reply soon

July 11, 2005 8:05 AM

how can i tackle lsass.exe me in detail

July 11, 2005 8:41 PM

Check out the links in the article you just commented on.

David D
July 24, 2005 12:21 PM


Do you know what the fix for this is: I have XP-P. My Internet Explorer home page and desktop have been hijacked. Uniquely, the same invader opens my CD drawer every few minutes and throws up a sign saying I urgently need their security system because I have "evidence" in my computer. If I put a CD in my drawer, the pc no longer recognizes it, the screen that should show that drive as opening on command is blank. If I put my CD into the second drawer, which does not open by itself mysteriously, the pc says I do not have a disc in it. This has made it impossible to back up my files for a re-format.

Nortons 2005 SystemWorks and Nortons firewall has done no good, obviously. AdAware SE has found some objects in my registry but evidently cannot get rid of either them (although it claims to have at the time of scan) or whatever this intruder is.

Since I cannot find a name for it, I cannot proceed in any way other than to get an expensive re-formatting.


Thank you.

July 24, 2005 4:27 PM

I would try another scanner. Microsoft's Anti-Spyware program is my recommendation, but there are others:

I am an idiot
October 14, 2005 3:56 PM

I accidently deleted lsass.exe, how the !@#$ do I get it back?

Please help, I dont want my comp screwed forever.

November 23, 2005 6:57 AM

run stinger it will remove the sasser/blaster
virus run sfc /scannow from the start run cmd
if you have your xp cd try a repair to replace file after cleaning the virus

December 4, 2005 9:34 AM

I have 6 windows task manger processes. isas.exe, spools.exe, msmgs.exe, taskmgi.exe, csrss.exe, svchost.exe. All of witch need to be deleted but i have no idear how to do the without messing up my system! could anyone help me?

Leo A. Notenboom
December 4, 2005 9:41 AM

Why do you say thel need to be deleted? Very likely that your system WILL NOT RUN WITHOUT THEM.

What problem are you really trying to solve?

December 15, 2005 3:55 AM

can i delete isass.exe

December 15, 2005 10:10 PM

If you typed it properly, yes. isass.exe is a virus. You should run a virus scan.

December 20, 2005 1:18 AM

HI i am trying to delete isass.exe from my task mgr and from the whole system how could i do that i ran a virus scan it doesnt work, i deleted some some trojans or virus but that one is not letting me anyone know how, thanks..

December 27, 2005 11:35 PM


I have found the lsass.exe in my strtup menu today and can not uncheck it or get rid of it. I have scanned with my updated Antivir antivirus and virus detected. the file started today and it is in C:\windows\lsass.exe and not in system files. Also it is in HKCU\software\microsoft\windows\xurrentversion\run. in regedit says localauthority service in the HKCU. I have checked its properties and it says microsoft file and on the registry. I have checked it and all indications seems its a real window file but I do not know what to do? I appreciat any help. I think I may havegot it whan I downladed two new antispyware such as xsoft and pc spyware and adware remover. I have uninstalled these programs but it is still there.

I-Love-My-CPU :)
January 3, 2006 1:00 PM

Get to know your computer better! :)

As stated earlier, isass.exe can posibly be a virus, so run a full virus before you do this. Also run Ad-Aware (make sure you update these programs). I don't recommend "Microsoft Anti-spyware program (as Leo does above {not the real Leo}) as it is still in beta and loads more processes than it stops. By the way, by all means Keep "Xoft Spy Remover" (one of the best, "Spyware Blaster" is another very good one)!


Open = "Control Panel" =next= Open = "Adminstrative Settings"!
Now click on "Services"! Here you find all the services that are visable in your process manager.

=lsass.exe (essential)=
=spools.exe (if you use a printer)=
=svchost.exe (maybe two of these with no problems=
=taskmgi.exe (is the window u r looking at: Task Manager)=
=csrss.exe (essential)=

=isas.exe (will be gone)=
=msmgs.exe "Messenger"(of no use to normal user and is often used to spam you with Official looking Windows Popups. This is a very simple network messenger not same as an online Messenger Program.
In the "Adminstrative Settings>>Services" you can right click/menu and choose properties. Click on the dropdown box next to it, Choose "Disabled"! If the process is running you can stop it here as well.

If you want to experiment with other processes then first look at the icons in the "Services" page. You will see one on =mouse over= called "Export List". Here you can save a list of the setup you have before you start tinkering. Preferribly get a screenshot of the "Services" page. This could save you if you make a mistake. But the saved screenshot will be much easier to decipher later. ;)

Best bet, before you make any permanent changes is to just stop a process for awhile and then use your computer. See if everything runs all right. If it continues to run fine doing everything you normally do, then you know you can "Disable" it. But write the ones down you disable on paper just in case.

Oh yes do have a "Firewall" installed and running. I recommend "Sysgate Personal Firewall"! It was recently bought by "Symantec" (Norton), but is still free and still better than their pay for one. ;)

January 5, 2006 1:56 AM

how do i delete the Isass.exe file from my computer.. because it destroy all my application..?

January 14, 2006 2:18 AM

hey why do you say I need to leave svchost? I once had something from the internet which slowed down my comp(very badly) called istsvc. I managed to remove it with task manager. now I have this svchost, I have 7 of them and they slow down my comp too(not that much as istsvc). From what I know they are bad and need to be removed. I don't care if those things are not viruses or malware or they will mess up my computer, I just want to remove them. Please tell me how. I'm pretty sure that when I reinstalled windows I never had these things

Leo A. Notenboom
January 14, 2006 4:40 PM

I really don't know how to make it any clearer that the article at the top of the page: svchost.exe (in the system32 directory) is part of windows. svchost is required. If you delete svchost Windows will not work.

See also

January 23, 2006 3:04 PM

Leo please explain the difference between Svhost and Svchost.exe the difference is a c and it a system file imitator like isass.exe is from Lsass.exe and most probably is a virus however i can freakin remove isass.exe i contained it with my firwall its not a Sasser coz neither Norton Anitivir Panda Titanium or Pc Cillen trend micro or all the (pay me im top on the list AV junk)doesnt sees it as a virus
I got 2 process isass.exe(c:\Windows\isass.exe)(virus) and Lsass.exe(C:\windows\system32)(MS authen contoll whatever)now how to remove?!!!

February 1, 2006 4:19 AM

Thanks for responding to me but I still need an answer for my question, may be you have not heard my question. My question is how can I remove some from google search? If you can tell me the intructions to follow or to perform.

February 1, 2006 10:03 AM

You mean from google search *results*? That's this article:

February 9, 2006 3:34 PM

I'm having an issue with isass.exe, lsass.exe, and I ran my Antivirus and it popped up as lsass.exe is an infected file, and it wont clean, delete or even quarentine. How the hell do i get rid of this annoying little pest?

March 3, 2006 7:57 AM

I want to remove the lsassexe file can you help me

March 3, 2006 9:17 AM

Don't do it. Read the article.

April 15, 2006 9:55 AM

my system is suffuring from lsass.exe I want to remove lsass.exe for ever please help me how can i remove this voirus for ever

April 15, 2006 10:10 AM

I see 6 or 7 svchost things running in my task manager. I assume they are needed so I will not touch it. I also see lsass, but after all I read, it must be needed. But what is winlogon.exe, spoolsv.exe, or services32.exe...I ave noticed when i do scans with Adaware and HijackThis that alot of services32, system32, and win32 things come up? What is wrong with my computer?? I keep getting pop-ups.

April 24, 2006 9:53 PM

i got the file named as Isass..exe..iam wondering is this s virus or any harm full content like that for my pc

April 24, 2006 10:08 PM

Isass.exe is probably a virus. Get a good virus scanner, make sure its database is up to date, and scan to repair.

May 1, 2006 4:25 AM

is there any special program to remove svhost virus?

May 8, 2006 11:54 PM

you cannot delete the Lsass.exe , you can install the patch .If you delete it your pc won't work .

Furqan Hameed
May 10, 2006 2:25 AM

I am facing the problem of svchost.exe. Please guide me?


May 17, 2006 10:10 PM

but Isass.exe is a trojan in windows XP home edition and also service.exe therfore do i delete this 2 trojans and if yes, HOW?

May 17, 2006 10:19 PM

Using a good Anti-Virus program

May 17, 2006 10:30 PM

recommendations? for a gd antivirus program?

May 17, 2006 10:33 PM

anyway,i have reformat my com but this 2 trojans kept appearing...are this 2 trojans considered to have keyloggers in it?

May 17, 2006 10:38 PM has several AV program recommendations.

June 4, 2006 8:20 PM

You can delete a virus by starting up in safemode. Then perform a search for the executable file. Find it and trash it immediately. You can only delete a virus in safemode, otherwise, if i you are using your OS in regular, the system will know its being used and wont delete it.

June 4, 2006 8:29 PM

Anti-virus programs dont really do jack. pardon my jargon. I performed system scans for spyware and viruses, came out clean, but i still saw the spyware in my taskmanager and the scans read as clean. It is bull.

June 10, 2006 10:01 PM

where do i get this patch?

August 12, 2006 7:26 PM

error and my archive appcompat.txt help me please

August 12, 2006 7:27 PM

i my svchost.exe.mdmp and

help me

September 22, 2006 5:36 PM

lssas is not a virus but sasser infects the exe.

a good antivirus would be bit defender...

October 16, 2006 5:11 AM

I was disabling some programs in msconfig and must have done the computer will not bootup gets to the windows xp emblem and then goes black with the Isass.exe-error message. How do can I get passed it to enable the program?

Anthony Landon
December 18, 2006 3:38 PM

i have at least 6 svhost.exe on my computer and the Isass.exe program, i cannot delete them, i triee running my anti-virus scan and it said there is nothing wrong, my coputer is getting really slow. can someone tell me how to get rid of it?

December 24, 2006 10:42 PM

Try using regmechanic to make your computer faster, if that doesn't work, try looking for other processes that are disrupting your computer. I currently have 6 svchost.exe running, or more, and my computer is fine. I also recommend computer cleaners, like "CCleaner or Webroot Window Washer."

December 25, 2006 7:34 AM

my anti virus keeps on telling me that svchost.exe is a virus but i cannot delete it plz tell me how 2 delete it

January 27, 2007 7:32 AM

double check whether you are dealing with svchost or is kind of important.

February 2, 2007 8:38 AM

my pc has a virus thats name is svchost, that i cant delete. how i can remove it plzzzzzzzz help me.

February 2, 2007 8:42 AM

my pc has a big virus thats name is svchost.exe. thats are not deleting. how i can remove it plz help me

February 16, 2007 11:55 PM

svchosts are not always bad they are sometimes used by prog's by windows to operate, just because you have a lot o f them doesn't mean that you have a bunch of viruseses. :-P

February 27, 2007 1:17 PM

Can I delete lsass.exe? svchost.exe? my system etting slow its a sevior headache for me help me pleese

Leo Notenboom
February 27, 2007 1:34 PM

Hash: SHA1

Please read the article you just commented on.

Version: GnuPG v1.4.6 (MingW32)


March 21, 2007 6:31 AM

I have the same problem svchost.exe right off of start up is running and nothing else will run
till I bring up task manager end task then I can start running programs again. but then later on iexplorer will run but evertime I close it an about/blank will pop up

April 6, 2007 10:33 AM

i have deleted the lsass.exe in my system while using the anti virus. Still it is very slow and svchost.exe also present in my system. plz suggest me how to rectify this problem.

May 11, 2007 4:34 AM

Please, do not even try to delete your svchost.exe-file. Doing that might destroy your system (not physically). It's the main process, which opens other processes when you start your system. The scvchost.exe-file is infected if it causes viruses. It should be replaced with a clean one, which could be done by reinstalling your operating system. There might also be a program that could repair the file. Blocking the svchost.exe isn't good either and if you attempt to stop it from the task manager it will send a pop-up with a timer. Then the countdown begins and the system will close in 60 seconds.

S. Mpata
May 25, 2007 7:35 AM

I moved svchost.exe to the recycle bin. Now my system is not working properly, for instance I can't copy&paste or run a search. What do I do? Please help!!!!

Joao Paulo
November 3, 2007 4:37 AM

Do not remove lsass.exe and svchost.exe!! these isn't virus!! it must be infected by a virus!! if you exclude this files the system will not work right!! try to heal the file with an antivirus or replace with a clean file!!

November 7, 2007 5:17 AM

I had a virus in my computer. I instalalled a new virus scan nod32 which detected the virus and deleted a lot of them, togather with this i guess it deleted SVCHOST.EXE. NOw when I startup my compute. I get a message stating svchost.exe not detected.
I can't open my taskmanager also, which probably could be because of this.
I would like to know how can I Install an svchost.exe from and how can I get My task manager functiong

aubrey david
February 26, 2008 1:53 AM

i cant seem to shut down my computer the usual way..instead i am required to open my task manager every time, end task ISASS. exe before i could turn it off... i believe it is infected by a virus or can i resolve this?..please help.

June 6, 2008 2:43 AM

Hi Leo, I have deleted lsass.exe & smss.exe after my laptop infected with Funny IST scandal from the registry. I was not aware that these are windows files and essential for system to run. Now I am not able to boot my laptop, is there any solution for this?

Thanks in advance.

June 6, 2008 9:27 AM

Hash: SHA1

You'll probably have to perform a repair-reinstall of


Version: GnuPG v1.4.7 (MingW32)


Jimmy Wong
August 23, 2008 12:31 AM

I'm confused, got a alert from norton internet security, indication low risk, so what to do block or grant access to the internet for lsass.exe, pls help. Thanks all for the comments.

November 20, 2008 11:59 PM

Uh, Yeah, I kind of sent svchost to the recycle and screwed up my computer.
I connected my stuffedup harddisk as a slave and was able to copy paste a svchost.exe file into windows32 but i cant seem to activate it.
I really want my files back!!
Everythings due at school now so acessing files is kind of crucial!

November 21, 2008 12:14 AM

K, Leo,
I've just read some more posts and im saddened to find out the SAFEST THING to do is reload windows. . . are there any LESS SAFE options that allow me to still keep my files?

November 21, 2008 12:24 AM

Sorry Here is my predicament saidmore clearly.
I deleted svchost.exe
I found a copy of svchost.exe
I put it in the windows32 file
My computer sees it and says theres an error (sorry dunno what it is right now)
Is there a way of properly activating it or fixing it.
I wouldlike to avoid reloading windows.
PLEASE HELP (Hope this was clearer)

April 1, 2009 6:29 PM

hi Leo, can you help me w/ my problem of SVCHOST.EXE that is eating up my memory/cpu usage.. i'm using windows xp sp2,can i have a step by step manual correction for this matter...

May 9, 2009 2:43 PM


My svchost.exe i guess it is infected
because each time i upload a file to my hosting, it looks fine, but after a while , i see a java script line added to my index page and this is malaware . in google my sites started showing that it this site might harm your pc.
i made format to my pc, and again i was attacked by the same problem,

I tried 4 different hosting companies, they said that someone has access to my passwords to do that, i changed password and still same problem.

i was reading

so how to deal with that?

Frank Rojer
May 18, 2009 8:29 PM

I have three or more entries of svchost.exe in TasK Manager.
When I end the svchost process with the highest CPU-time
after som time i get the message that a shutdown is coming.
For that I am prepared in cmd to abort that shutdown.
Is this a virus.

I have a screenshot of task manager but I do not know how to send it to you.
Zone Alarm detected 55 attempts to go outbound.

Before that I had 1175 viruses all of them with names of
I removed them with a trial of Avira Pro.
I am using Virtual PC on a Mac G4 (QuickSilver) 2 processors
and 1.5 Gb core.

Have a nice day!!

April 25, 2012 6:02 AM

Why does lsass.exe happily "export" data from my computer without my consent or knowledge ?. I observed this when I recently installed PC Tools Firewall Plus. Chunks of outgoing data was been recorded which originated from this program. Over 2 Mbytes had already been recorded as outgoing and about 1.5M as incoming by this exe.
I have now used PC Tools Firewall Plus to completely block it and Nothing is now being "exported" nor received. Windows does not appear to have any problems with it being blocked from accessing the Internet.
I was always wondering where the extra use of my bandwith was coming from and it now appears that I have found the culprit.
SvcHost as far as I can see is essential but it shows no abnormal activity.
So what is lsass.exe really is it Microsoft Spyware?
What is it's function ?

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to to ask your question.