What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Get and run an up-to-date virus scanner. Recommendations here: http://ask-leo.com/d-recommend

I am attempting to download the patch and use the removal tool, however shutdown -a does not stop the shutdown process on my system. I am running Windows 2000.

I get a message saying "Cannot find the file 'shutdown' (or one of it's components) Make sure the path and filename are correct andt that all required libraries are available.

Thank you.

Greg: some of the steps in this article may help: http://ask-leo.com/archives/000253.html

Misty: this article http://ask-leo.com/archives/000003.html includes links to a tool called "psshutdown" that will do the same thing. Good luck!

Hello I believe I have sasser or some variant. I have formatted my C drive and deleted all partitions several times but as soon as I reinstall the Operating system (windows 2000 or Xp) I get a reboot error within 60secs and error from lsass.exe Also as soon as I connect to internet all bandwith is used by some thing on my pc. It is incredibile. I though that a format C: would have got rid of this virus. Do you have any help for me? I have tries Norton, Mcaffe , Grisoft AVG and Avast antivirus and also spybot none of these software detect my virus. I am despeate. Please help.

Thanks
Sami

Are you on a LAN with other machines? If one of those is infected, then it could be that you're getting reinfected immidiately upon connecting to your LAN. Physically unplug from the network and see if that allows you to get further.

I keep getting the shutdown screen in 60 seconds when I am using a modem (only when I'm on the road - usually I'm on a network). Norton does not detect the presence of a virus of any sort. Can you help me?

John

You're probably being attacked, and don't have the latest patches. Make sure windows is up to date, and if you're running Windows XP, enable the firewall when on the road.

Hello, i had the same troubles, i love to spit in my machine and i found lsass.exe en dirote.exe, it was hard to delete it, i killed it with ewido security site, search it on Google, and look at your processes after you installed the freeware program, i tried also to rewrite the file dirote.exe after ewido found it in my registry and it succeed, after that I had bought a norton internet security installed and al my problems are now over...can i say with my fingers crossed, and when someone has questions email me, it works and i will help.

Greetings from the Netherlands.

I'm used to reading English written by the Dutch, since my relatives are all in Holland ... but I hopt that "i love to spit in my machine" means something other than it actually says. :-)

Leo (Notenboom - a very Dutch name :-)

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.