What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I have windows xp pro and i just got the message:
lsass.exe, and It will not boot up, can't even get to the system to do any work, is there any hope? I was thinking if there's a way I could download the info to a cd and maybe run it on this computer. any chance of that?
Any help will be deeply appreciated, if your idea helps, I'll send you a cool T-shirt

Dok Washington
dok73@cox.net

You can try running a repair install of Windows.
http://ask-leo.com/how_should_i_reinstall_windows.html

I have Windows XP home edition. On start up i get a system error saying lsass.exe "Object name not found" and on pressing OK the machine reboots. This goes on and on. I cant even start in any of the safe modes. I am totally clueless as there is no mention of this error even on Microsofts website. Please help!

You'll need to reboot from CD and perform a repair install of Windows. http://ask-leo.com/how_should_i_reinstall_windows.html

Thanks for your prompt reply but my problem is that i cannot access the files at all and thus cannot take back up. The error message appears immediately on windows loading and on pressing OK the machine rebots so there is no way I can take a back up. What are the other ways of taking back up before reinstalling windows? Thank you.

Well, a repair install should install without destroying things. I agree a backup first is advisable, but not always practical. I'd look into bootdisk.com and see if you can come up with a disk you can boot from that perhaps woudl allow you to back up across the network.

Ashutosh, it sounds like you've got the same problem I've got. If you'll go to page 35 of the posts to this article and follow Andy Hudson's instructions to install a second copy of XP to Windows2 folder, you'll be able to find your files that need backing up. You can then burn a cd or save them to a jump drive. You'll have to enter BIOS by pressing (probably)F1 immediately after startup and set your machine to boot from cd first. I still haven't got my pc fixed, but I was able to retrieve all my data. If you'll read this entire article, you'll find all sorts of good ideas to try, it just seems some infections are harder to recover from. My next step is to format and reinstall.
Murph

I have learned a lot from these pages but the instructions do not go all the way for those of us not cumputer "savants." For example, I can follow the logic of re-installing Windows XP in a different folder to bypass the "lsass.exe" worm virus I somehow got, but it did not tell me SPECIFICALLY how to do this. I am working with a laptop for the first time & it got into some terminology about partions and UNpartitioned space. If someone could walk us ignorant folk on which options to choose and how to actually DO the re-install into a different folder, it would be much more helpful. I will continue to write comments tonight as I try to work through this very inconvenient problem. Thanks for hearing me vent!! ---CC in Seattle

Are most of the viruses corporate-based? Dont u think Microsoft and Norton are the biggest viral organization? Its a shifty marketing strategy to create your own enemy and then destroy it!

If you cannot boot into XP you can resintall XP over the top of itself by booting off the CD and using the reapir feature. Conversely, if you have a HP or Compaq you can press F10 on boot up and use the non destructive recovery option to repair Xp. This usually leaves all of your non system files intact

HPH

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.