What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

A BLUE SCREEN COMES UP ON MY COMPUTER FOR ABOUT 5 SECONDS WITH LOADS OF WORDS BUT I SAW THE WORDS REGISTRY ERROR, I'VE TRIED SAFE MODE, EVERYTHING, IT WON'T COME ON. iT JUST KEEPS RESTARTING. CAN'T TYPE NOTHING ON IT. HELP PLEASE

I'd look into a repair install of Windows. This article has more: http://ask-leo.com/my_computer_locks_up_and_wont_boot_what_do_i_do.html

hi buddy
this is solutionof LSASS.exe
write downSpecify Executable Files to be Lauched by Winlogon (Windows NT/2000/XP)
Category: Home > Security > System

This tweak can be easily applied using WinGuides Tweak Manager.
Download a free trial now!

This setting specifies a list of executable files to be run by Winlogon in the system context when Windows starts.

Open your registry and find the key below.

Create a new String value, or modify the existing value called 'System' using the settings below.

Exit your registry, you may need to restart or log out of Windows for the change to take effect.

(Default) REG_SZ (value not set)
System REG_SZ "lsass.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Settings:
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Name: System
Type: REG_SZ (String Value)
Value: (default = lsass.exe)

mail me jaipurhandsome@yahoo.com
bye

I couldn't buy you a latte !! The link ain't there, man. I'd love to, but I just couldn't get any of the PayPal links to go anywhere.

LOL... thanks for letting me know! I fixed it.

if lsass.exe is anywhere but C:\windows\system32 remove it..........

my system shutdowns showing an error that NT authority has initiated the shutdown because of the error in c:\windows\system32\lsass.exe

can you suggest me how to over come this problem?

Follow the steps in the article. It sounds like a classic case of the Sasser worm.

I have the same problem on windows 2003 SBS....is there any hope to fix without a reload?

I have the error msg "Lsass.exe "When trying to update a password the return status indicates that the value provided as the current password is not correct". I can not apply any of the fixes from the "start" "Run" or C prompt as the pc shutsdown and restarts and shutsdown and.....
before the taskbar has a chance to come up. Is all hope lost? I would be grateful for any advice.

Posted by: Shelby at July 25, 2005 01:04 AM

I would try rebooting in safe mode, or booting from the CD-ROM into the recovery console. If that doesn't work, then I'd boot from CD and attempt a repair install.

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.