What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I have the lsass.exe worm and i am trying to remove it but every website i go to and use their virus removal tool says i am not infected. HELP

Dear Jana

lsass.exe is no worm, no virus and no trojan. It's a file from Microsoft for manage the system rights.
either it's sober:
http://www.symantec.com/avcenter/venc/data/w32.sober.removal.tool.html

or it's Lovegate:
http://securityresponse1.symantec.com/sarc/sarc.nsf/html/w32.hllw.lovgate@mm.html

if someone knows something else, that it could be, please mail me!

You're correct Jasmin, LSASS.EXE is a part of Windows - it's a required system file that happens to show up in the error message when you are infected with any of a number of different viruses. You list two, there's also Sasser and several others. THe best thing to do it to keep your virus signatures up to date, run virus scans periodically, and even scan with a second AV program from time to time. And of course follow the other steps in the article.

is it possible to include a small SASSER fix on this website?

I've provided pointers to the fix in the article.

I was wondering if totally wiping your harddrive and reinstalling xp pro will get rid of the sasser virus? If it does will previous files i saved on a cd when i had the virus still be potential infectors?

It depends on the files, but the short answer is probably yes. The safest thing to do is to run a virus scan on those files before you copy them back. And make sure that when you reinstall you're protected by a firewall so you don't immediately get the virus again over the net.

i forget my windows 2000 server administrator password
how to change my password or do i reinstall it

Can someone post a link with a list of possible virusses and trojans that uses lsass.exe?

I try to find out wich one my friend has. I tried Sasser, Blaster, Sober and Lovegate, but I didn't found the right one.

There's not much point as the list changes almost daily. My recommendation is to use a virus scanner and it will report which one.

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.