What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Given that we don't know everything that's now happened to your registry, the only think I can suggest it is a reinstall of Windows.

>>>Hey Schnazola! I read your comment about using Knoppix. I am pretty new on the whole Linux system....

Leo,
About the LSASS.EXE article. This can be a trojan, but it is also a very necessary Windows component file. No one should delete it without knowing the location as this has a lot to do with whether it is a virus or not. Spyware uses this file, also. Microsoft claims that WinTasks 5.0 can help with this problem.

Ok, so this regards to the lsass.exe error endpoint format is invalid...
It seems as though I have fixed the problem though it took quite sometime (I use SP2 Win XP Pro)
1) boot your comp w/ the win xp cd in and repair windows
2) once there I did a chkdsk /r which took about an hour but found several errors on the disk and fixed them
3) I rebooted by typing exit but found no error msg but STILL rebooted by itself
4) tried to reboot into safe mode by pressing F8 but decided to go into debugger mode which is like safe mode i guess..?
5) installed registry mechanic full ver. on the compe and ran a full deep scan -- found over 900 bloody errors on the registry!!!!!!!!!!
6) rebooted. and work impeccably.
i hope this helps anyone with this problem, it was not fun and i thought i was gonna lose everything but found a workaround
Have fun,
Morgii

I found a possible remedy at the HP site for the black screen effect. The website is
http://h10025.www1.hp.com/ewfrf/wc/document?lc=en&cc=us&product=89876&dlc=&docname=c00254484

My son's PC was infected by LSASS.EXE. I removed from my system by access the registry (regedit). used the "Find" option under the edit menu and located the all of the key values that contained lsass.exe and deleted them. It solved my problem. Good luck..

Windows is complete garbage, but unfortunately we are almost required to use it nowadays. What the other people say is true; you will end up having to format your HD and install Windows XP again. I had that error before, as well. What none of the Microsoft Techs, or most other advocates of this horrible OS, will tell you is that there is a way to get the data off that you need.

You use something called a LiveCD / LiveDVD. It is a version of Linux that is booted from the disk itself. You can use it anytime that you would like. Hell, my Windows works fine and I use it my computer occasionally just for kicks. By booting the computer while this disc is in the drive, you can boot into Linux before Windows. This will allow you to use a CD/DVD burner (internal or external) or a flash drive to get all of your data off and onto discs or another computer temporarily. Just be sure that all peripheral devices (including removable media) are plugged in prior to booting into Linux, otherwise Linux may not recognize it.

I clicked on a link in some search results and was immediately notified that a program was trying to access the internet. I blocked it. Still, a program called "lsass.exe" was loaded into my start-up programs. My anti-spyware allowed me to disable them right away. I then ran scans that said my computer is not infected. Still, what a scare. Never click on links and I recommend SpySweeper!

Just don't use "spyware stormer"... That is how I ended up with the System Error "The endpoint format is invalid"...It deleted registry values, and now my puter is FUBAR.

leo, when I have searched thru and opend the hosts file in note pad, I see somany web addresses there. Many of which are links to porn sites. Does this mean I cant access those sites, I mean; what are the links doing there?

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.