What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

thanks Leo, but the virus scan doesn't work..

I'll try another one. Hopefully it will find the right one.

i have a problem with my computer it shuting of after one minute and massaig comes "lsass.exe" some writing is there also.

Yes, you should follow the instructions in the article.

hey leo, similar to sasser, i get an error lsass.exe-system error, invalid parameter etc...but my comp shutdowns immediately. plus i was running windows xp repair/blanket install, so its permanently stuck at installation splash screen. any ideas? thanks.

Hey leo if you are completely updated with nortan antivirus and scan your harddrive should it detect the sasser virus? I am completely updated but i originally installed nortan 2002. Also i am expiriencing another problem. At some point a system file called svchost.exe starts to sap my cpu usually taking as much of the processing power as it can and my other programs run like molassas. If I end the process It will display the shutdown in 60seconds window. If i run shutdown -a it will stop but the taskmanager items retain their user identity instead of reverting to unknown and i regain my cpu power Is this the sasser virus?

Hi, I am not sure what I have and how to get rid of it. I get a pop up box when my PC is booting that says "Lsass.exe" at the top in the blue bar and then in the box itself it says "Item not found". I get this before my PC fully boots so I am not able to go to my start menu or anything. Best I can do is hit F1 and go into setup. Is there anything under setup I can do to stop this from happening so my PC will fully boot?

Chris: I'd try booting in safe mode to see if it'll get further, but ultimately I think you're going to have to boot from a floppy or CD so you can run an AV scan and repair your system.

Brice: yes and no. The problem is that new variants are coming out every day, and the AV software manufacturer;s are constantly playing catch-up. Definitely keep your virus signatures up to date - I check for new virus definitions daily. The SVCHOST issue also sounds like yet another virus - http://ask-leo.com/archives/000105.html

Jen: if it's the setup I think it is, no. You're in the same boat as Chris - you'll need to boot from floppy or CD-ROM to repair your system. Perhaps even reinstalling it will be neccessary. Be sure that a firewall is in place before you connect to the network to avoid getting immediately reinfected.

I got the sasser virus, but I had no idea what it was. I cut the lass.exe file (removed it from windows) and pasted it on my desktop. I restarted the computer, but now it go at all. All I get is a black screen and the cursor works and that it. What can I do to solve this problem?

To post a comment on "What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?", please return to that article's main page.