What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I'd make sure you were behind a firewall ... sounds like you're getting re-infected fairly quickly. Also sounds like you're not completely patched and/or up to date.

I had troubles with Sasser in June, cleaned my computer and now it's OK.
I'm now looking through my computer and find in \Windows\PCHealth\ErrorRep\UserDump more than 100 files named : "lsass.exe.20040505-191212-00.hdmp" (264 MB!!!!). Can I delete these files?
Thanks,
Leslie

I sure would. If you're at all concerned, first copy them to some off-line storage (i.e. burn them to a CD-ROM) in case for some reason they'd need to be replaced, but it seems unlikely.

look at http://www.processlibrary.com/directory/files/lsass/

I have a runaway task: lsass.exe and I can't get it to stop. My task manager shows my cpu usage to be a constant 75-100%. Lsass.exe as a process is using 84,904K of memory. I don't think I am infected with a virus: I have been running updated antivirus and firewall. Are there any known problems with this program other than virus infection? Any help would be greatly appreciated.
Ben

All the cases I've heard about so far has been virus related - either being infected, or being under attack. So I don't really have any good answers for you. If that's a hardware firewall, and there are other machines behind it with you, you might double check that one of them isn't infected and attacking. Might also be good to use an additional different virus scanner, and double check that you're up to date at windows update.

hi there, every time i run my virus checker, it runs for so long and then restarts my computer. is there anything i can do to stop it shutting down so as i can run the full virus checker??

sorry, i forgot to mention im on windows xp

I'd try another virus checker. There are several free on the net (check my recommendations page: http://ask-leo.com/d-recommend )

I have computer running with Windows 2000 Professional. Now the problem is that, when i start computer it will automatically
shut down after some time and searched for this is error and it is due to lsass.exe worm problem.
I am really frustrating of getting this error. I also found that this error due to lsass.exe virus. Is this true? My computer shutdown due to this lsass.exe shutdown error. Suggest me how do fix this lsass.exe error?

I am very thankful to you if you will suggest me any solution.

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.