What is (lsass.exe)

  Arokh. 15:58 19 Jul 2004

At work I use a Windows 2000 PC, and the PC Intermittently and Inexplicitly turns off, The PC Does not crash, it informs you that the pc will turn of in about 1 minute, then asks you to close all programs, it mentions this file (lsass.exe), when I got home I checked my PC for this, assuming that is part of the virus called Sasser, or whatever, well I have this too.

My PC Runs Win XP Pro and I have heard that this virus affects XP and 2000 PC’s, is this true?

I regularly check my PC for Virus’s and I also download the latest Definitions, Currently I am not experiencing any problems, however I am concerned this virus is a “Time Bomb” type Virus.

Am I getting Paranoid?



  2neat 16:00 19 Jul 2004

sounds like a virus or worm. Make sure you visit windoze update and apply all critical updates. Then look at Microsoft sasser removal tool.
Good luck

  Kate B 16:04 19 Jul 2004

Yup, it's Sasser. Do a search in the forums - there have been several threads on the subject,

  Arokh. 16:05 19 Jul 2004

Hi 2neat
When you say it sounds like a virus or worm, who's PC are you refering to, Mine or My Works.

  ventanas 16:08 19 Jul 2004

click here\security\incident\sasser.mspx for removal instructions

  ventanas 16:09 19 Jul 2004

Sorry the link is flawed. Where it says "click here" type www .microsoft.com (without the space)and add the rest of the URL.

  ZEROTOLERANCE 16:10 19 Jul 2004

i agree with 2neat, download the free "STINGER" or "FIXBLAST" TOOLS They may remove it. ive been hit 2wice in the last month by worms, an they got 1 each straight away, unfortunatly i didnt take notice of what they were called, but i hope 1 of thems able to help you, sorry couldnt be of more assistance.

  ventanas 16:14 19 Jul 2004

click here for Stinger, as Zero says this will also remove sasser.

Zero, do you still want the CD with SP1. I havn't heard from you.

  SANTOS7 16:32 19 Jul 2004

click here dont be mistaken for (Lsass.exe) which is the one linked to sasser

  Deep 16:38 19 Jul 2004

Process name: Local security authentication server

Product: Windows

Company: Microsoft

File: lsass.exe

Security Rating:

"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token. More info

Note: The lsass.exe file is located in the c:\windows\System32 folder. In other cases, lsass.exe is a virus, spyware, trojan or worm!

  ventanas 16:42 19 Jul 2004

Very true also click here to avoid any confusion between Lsass and Isass. Depending on the case of the first letter, both can look the same.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Xiaomi Mi Mix 2 review

What went wrong at the Designs of the Year 2017

iPhone X news: Release date, price, new features & specs

Comment regarder des séries et talk-shows américains en France ?