lsass.exe??? Virus?

fred381 · 02-06-2007, 04:37 PM

There is a process on my computer called lsass.exe, and i was wondering how to remove it if it is in fact a virus. I'm kinda new at this stuff, so any suggestions would be greatly appreciated. Thanks a lot.

DylanO · 02-06-2007, 05:21 PM

Isass.exe is a system process of the Microsoft Windows security mechanisms. It specifically deals with local security and login policies. This program is important for the stable and secure running of your computer and should not be terminated.

also..
LSASS.exe is responsible for running certain groups of drivers (.dlls) associated with several background services in windows xp.
If this file is using a lot of cpu reserve it is probably because it is sitting on quite a few .dlls whilst attempting to launch one or two services.
The only way to contol the services that windows runs in the background is to roll up your sleeves and get under the bonnet
and configure them one by one
You'll find them here: Control Panel / Administrative Tools / double click the last icon "Services"
Expand the page to get a clearer view then click once on the first icon "Alerter". In the left hand panel will be a description of what this service does. Now right click the icon and choose "Properties" from the drop down menu, in the center panel next to "Startup type:" is a drop down allowing you to set it to one of three modes, it is here that you can configure each service in turn.

But then The lsass.exe file is properly located in the c:\windows\System32 folder. if you find it anywhere else on your system, it's actually a virus, trojan, worm or even spyware, and should be deleted!

There are three viruses I found evidence of that use either this exact filename or a darn similar one:

* W32.Nimos.Worm
* W32.Sasser.E.Worm (Lsasss.exe)
* W32.HLLW.Lovgate.C@mm

- Dylan O.

fred381 · 02-06-2007, 06:47 PM

Yo, dylano
Thanks a lot, bro

**Detah** · 02-09-2007, 08:45 AM

DylanO gave you some good advice. I just want to reinterate and add one little thing.

lsass.exe should be found only in your OS's system dir.
lssas.exe (note spelling) found anywhere is a virus. A pretty nasty one too. These are particularly nasty bugs that will allow another user to control your computer remotely.

02-06-2007, 04:37 PM	#1 (permalink)
fred381 Registered User Join Date: Feb 2007 Posts: 5 OS: xp	lsass.exe??? Virus? There is a process on my computer called lsass.exe, and i was wondering how to remove it if it is in fact a virus. I'm kinda new at this stuff, so any suggestions would be greatly appreciated. Thanks a lot.

02-06-2007, 05:21 PM	#2 (permalink)
DylanO Registered User Join Date: Feb 2007 Location: 127.0.0.1:1000 Posts: 94 OS: Windows XP Professional My System	Isass.exe is a system process of the Microsoft Windows security mechanisms. It specifically deals with local security and login policies. This program is important for the stable and secure running of your computer and should not be terminated. also.. LSASS.exe is responsible for running certain groups of drivers (.dlls) associated with several background services in windows xp. If this file is using a lot of cpu reserve it is probably because it is sitting on quite a few .dlls whilst attempting to launch one or two services. The only way to contol the services that windows runs in the background is to roll up your sleeves and get under the bonnet and configure them one by one You'll find them here: Control Panel / Administrative Tools / double click the last icon "Services" Expand the page to get a clearer view then click once on the first icon "Alerter". In the left hand panel will be a description of what this service does. Now right click the icon and choose "Properties" from the drop down menu, in the center panel next to "Startup type:" is a drop down allowing you to set it to one of three modes, it is here that you can configure each service in turn. But then The lsass.exe file is properly located in the c:\windows\System32 folder. if you find it anywhere else on your system, it's actually a virus, trojan, worm or even spyware, and should be deleted! There are three viruses I found evidence of that use either this exact filename or a darn similar one: * W32.Nimos.Worm * W32.Sasser.E.Worm (Lsasss.exe) * W32.HLLW.Lovgate.C@mm - Dylan O. Last edited by DylanO; 02-06-2007 at 05:49 PM.

02-09-2007, 08:45 AM	#4 (permalink)
Detah TSF Enthusiast Join Date: Jun 2004 Location: from IL; now in KY Posts: 647 OS: Win98SE/XP My System	DylanO gave you some good advice. I just want to reinterate and add one little thing. lsass.exe should be found only in your OS's system dir. lssas.exe (note spelling) found anywhere is a virus. A pretty nasty one too. These are particularly nasty bugs that will allow another user to control your computer remotely. __________________ Ich kann auf Deutsch helfen. Mach ein' post und PM mich. Peebs85 kann auch Deutsch. If I help you, please donate to upgrade our outgrown server. I will donate my time to helping you for free, but the server is not free. Please send donations to Jason Connors (TSF owner), 4410 Grandwood Lane, New Port Richey, FL 34653. Even if its only a dollar. Thank you.

02-06-2007, 06:47 PM	#3 (permalink)
fred381 Registered User Join Date: Feb 2007 Posts: 5 OS: xp	Yo, dylano Thanks a lot, bro