What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

hi,i have one problem,my laptop is suddenly shutdown in the middle of the work.it happeninig daily,my work is pending.what is problem.

There are so many possible reasons for this it's hard to say. Have you done a virus and spyware scan? How does it shutdown: crash, turn off or does it go into standby? What version of Windows? Is Windows fully up to date with patches? Is there any consistancy with what you're doing at the time it shuts down? Have you added or removed any hardware or software recently?

lsass.exe - unable to locate component
this application has failed to start because
LSASRV.dll was not found
re-installing may fix this problem.

Any ideas Leo? Thanks for any help!

Windows XP? I'd run the System File Checker to see if that repairs it. http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html

I have just now managed to recover from the Sasser worm. My antivirus "caught" the worm by deleting lsass.exe. Deleting this caused my computer to be unbootable. I had to use the recovery CD from Dell. I pressed F12 to boot from CD and then I had to press F8 to accept the service agreement. Next I pressed enter not R. On the next page I pressed R to re-install and the healing process began. My data was preserved and twelve and a half hours later my system is functioning again. Six hours of that was re-installing the windows service packs and updates!

I see that in your article about lsass.exe you refer only to sasser worm. Lsass.exe is windows system file and having it doesn't mean you are infected for sure.
http://www.2-spyware.com/file-lsass-exe.html

lsass.exe prevents my computer from booting; what to do?

Boot in safe mode, and run an up-to-date anti-virus scan.

None have suggested the proper patch that fixes the lsass.exe remote shutdown problem.. could anyone help?

As the article says, the "proper patch" is to run an up to date anti-virus program, and to make sure that you have all patches installed from Windows Update.

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.