What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

shutdown controls your system shutdown. The "-a" command instructs it to "abort any shutdown already in progress". When you are ready to realy shutdown or reboot your system, just use the Start menu, Shutdown option as normal.

Dear Leo,
My friend's computer had ALL the symptoms of the Sasser worm. We followed your instructiions up to the point of worm removal. She could not find any of the avserve, avserve2, netsky, etc. processes. Her computer no longer shuts down. We installed Stinger which found and destroyed W32/NACHILTFTPD.VIRUS, also referred to as the Natchi worm. I thought this worm was self-destructing January 1, 2004. She now has installed firewall and is updating all her anti-virus applications......YET, I still suspect she has a variant of the Sasser worm there somewhere. Any suggestions?

What version of Windows? If XP, have you run the system file checker?

Thanks, Leo.
She has Windows XP. Sorry to be so dim, but how do I run Systems File Checker?

Funny you should ask ... I happen to have an article on that :-).

http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html

Broken-link report: The checker is available on http://www.microsoft.com/security/incident/sasser.mspx

Thanks for the report. I've fixed the references.

Norman virus control seems not to recognize the sasser worm regarding lsass.exe
My company has got a lot a trouble with it,
and we are considering to use Symantec in the future.

Ole

I think I have the sasser virus. I rebooted my laptop this morning and I am now getting the following error: lsass.exe - System Error Object name not found. I cannot get my laptop to boot in normal or safe mode. Do I have any options available to me other than rebooting from the recovery CD and loosing everything on my HD?

Rebooting from the recovery CD does not imply you'll lose your data. You should be able to repair Windows with it.

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.