What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Oh Leo,

Yes i see what you mean, pardon me, i love my machine, and sometimes with troubles i hate him, but i ment to say DIG, look around, yes and Leo a really Dutch name, so i hope my info was interesting enough, bye and in Dutch,

Een hele goedenavond en tot ziens !!

I have just installed WinXP and the first thing that troubled me is this lsass.exe it forces me to reboot in 60 secs. What will i do? Will the security update solve this problem? Also the svchost, it eats a lot of my cpu power when I stay online for a while, what shall I do with this?
Thanks for taking time reading this problem.
Alex

Yes, you need to follow the steps in this article, including the one about the firewall. If, after that, svchost remains a concern, this article may help: http://ask-leo.com/archives/000105.html

I also get the lsass.exe error. It either gets to the windows loading screen, then 3 seconds later the blue screen of death and the computer restarts. OR is gets to the windows startup screen and says something about I/O and registry files. I also cannot get into safe mode at all to download the microsoft patch/fix. I was able to do that with my other computer on my network, and everything worked again. I am now trying to use it as a slave w/ another harddrive as my main drive, and it wont even read from the drive. It detects it in BIOS and in windows but all it does is automatically ask me if I want to format it and that is it. Lastly, I also tried fixmbr bootcfg/rebuild and chkdsk drive /r in the recovery console but neither of those worked. Im basically at the last straw here, but I know it can be an easy fix if I can just get into windows or safe mode somehow. Can you help?!?

I have had this problem for a while now. And thanks to you guys i have just figured a way to get rid of it. BUT..... i have reformatted a 2 times since i got this "virus". Is it possible that this virus stays in the hd even after i reformat? Because thats what happened to me.
The virus stayed on my hd and in my comp even though i reformated :S. Can someone tell me why this happens or does sasser always do that? Please email me or whatever.

errr sorry my email address is mrbutt_cheeks@hotmail.com

Usually that means you're getting reinfected immediately on reconnect to the network. Get behind a firewall.

And to answer your question ... no, viruses do not survive a format of your system drive.

Hi How can i slove this problem i am not getting removal tool.

Did you follow the instructions in the article?

thanks for the very straightforward directions. unfortunately i am unable to abort shutdown with 'shutdown -a'. any advice??

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.