What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

O.k here's a slightly odd occurance, Eoghan mentioned that their pc was shutting down anyway even after trying "shutdown -a". Well it seems my pc is infected with sasser or a variant, and for some reason after copying 'lsass.exe' (from Windows\system32), to my desktop and running it from there, it hasnt since terminated, and nor has my pc been forced to restart. Try that Eoghan, i have no idea if it is a fluke, but i guess it is worth a try.

so leo,

everything seems to be fine, but do i need lsass.exe for windows xp to operate or is this part of a potential problem?

thanks

LSASS.EXE is a required system component. The viruses just happens to cause problems that are reported as having happened LSASS.EXE.

Just out of curiosity. Does the sasser bug effect the disk defragmenter because after i got the bug off my PC i tried to defragment but nothing happens when i try to run it. Any ideas for this one?

I've not heard any reports of the defragmenter beign affected. If you're running XP, it might be worth running the system file checker http://ask-leo.com/archives/000074.html

Leo:
I have the same problem. Have every problem associated with the sasser virus, but when I scan or run the removal tool it finds nothing.I have updated my norton antivirus up to May 19. Could there be another virus? I've also checked for the Kibuv-B and Bobax, but they are not on the computer either. I even went as far as to check for the blaster worm, because I know it will start a computer shutdown too. I've had no luck. Please help!!
Beverly

Well, it's certainly possible that you're on the leading edge :-(. I just checked the Symantec website and just yesterday they posted another variant of Bobax. http://ask-leo.com/d-symantecavc - Not sure if the Norton definitions are up to that or not yet. Definitely make sure that you're patched so you avoid any new variants as well.

Well according to symantec the updates for this virus are on the 19, so I am covered there. I'm actually working on my bosses computer, (he's had this for a week) and I made sure that i updated and got the patch from windows. I've tried everything I can think of. If you have any ideas I would greatly apreciate it. (think I've got to the point of tearing out my hair hehehe)

I have been having problems with Outlook Express. When downloading e-mail, I get a McAfee alert that a virus has been detected and deleted (exploit-objectdata). Outlook then times out. When I quit and restart, I get the same message. If I go to Yahoo.com and download my email, all goes well. I delete all of the spam files then log on to Outlook Express and can access my files again.

I am also having problems sending files with attachments. Outlook times out and the file is not sent.

I am useing McAfee firewall and virus scan.

To me it really sounds like McAfee is interfering with attachments, both coming and going. Is it the latest version? Can you send properly if it's turned off? I'd be very tempted to go to their support site on the web and see if they have anything on this.

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.