What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

DO NOT DELETE LSASS.EXE it is a vital system component. Follow the recovery instructions from the article you just commented on ... which boils down to: run an up-to-date anti-virus scan.

As soon as I run my computer, windows attempts to load and I get the following error, "lsass.exe - Unable to locate component

This application has failed to start because LSASRV.dll was not found. Re-installing the application may fix this problem."

When I click OK the screen goes blank. I cannot get to any XP screen or function; same goes for safe mode boot up, same error. How can I boot up to a cmd screen ?

You need to perform a repair install from your Windows XP CD-ROM. Do not connect to the internet until you've run a complete and up-to-date anti-virus scan.

hi Leo i would like to reccomend a simple step for sasser and blaster worm or lsass error when system shuts down, restart the system in safe mode and turn off the port 445, then run stinger and sasser and blaster worm will be removed, to close port 445 one has to go to right click on my computer then click on manage select device manager click on view go to show hidden devices now under non-plug and play drivers select net-bios over TCP/IP right click on it and select disable system needs to restart, this has helped me a lot in troubleshooting sasser worm,

hello i dont know if the comutper has the sasser virus or not but at start up it goies to an error message
isass.exe system error
An I/O operation initiated by the registery
unrecoverable the registry could not read in or read out,or flush one of the filesthat contained the system image of the registy.
press ok
then it goes to starting window then restarts the computer a loops like this for a while and every so ofton it will boot up like nothing happens i have a registery fixer did the scan and it comes up with nothing does this sound like the sassy oh yea at first i thought it was a hard drive failure so i replaced that setup windows did all he download of updates and then it stated it
marcus thanks

Leo,

ref Gils Post on 27th - I have two laptops both running MS auto updates warnings (all security patches are loaded) and McFee auto updates on the full security centre, I run adware, spywareblaster and spybot on both laptops.
like Gil's we just started to have problems around the 27th. One laptop won't boot up (my son's)! we try and turn on, it starts Windows then freezes with a windows error box "lsass.exe - system error - insufficient system resources exist to complete the API"

if we click okay - like Gils - it starts all over again. It just keeps cycling the same error each time windows tries to boot up.

so I'm confused, I'm computer literate, no reason why the real Lsass should fail overnight, all protective measures in place on both PCs for virus, spyware, malware, but at the roughly the same time as Gil's problem we also have a problem -

but it does not match with news - if this was a new problem / variant millions would have been hit by now - and they have not - so !!! is it a fluke / coincidence and I need to reinstall windows ?

Leo,

One of my Win 2k3 is giving this lsass.exe error with the status code 1073740972. I don't know why this is happening. It wont even let me in through safemode. It restarts when I try to go on safemode. I got McAfee as my virus scan and ISA as my firewall. What is the port this lsass is getting infected? How to get rid of this situation? I followed your steps and I installed all the hotfixes. I hope I will not get this issue in future after these hotfix installation. But what if I get the problem again? What should I do?

Thanks,
Lakshitha

I got LSASS.exe message every time in my windows 2000 prof. system when I'm plugging my internet cable.Pls give suggetion how to rectify that prob. as soon as possible.

Thanking You,
SK Rana

Sounds like you need to get behind a firewall. http://ask-leo.com/do_i_need_a_firewall_and_if_so_what_kind.html

My computer completely lost everything. I restores Windows and then purchase McAfee AntiVirus and Firewall. When I try to load both I get this stupid lsass.exe and it won't let me quaratine, clean or delete. How do I fix?

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.