What is lsass.exe? Is lsass.exe spyware or a virus?

How to fix lsass.exe related problems?
1. Run Security Task Manager to check your lsass process
2. Run Windows Repair Tool to repair lsass.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware

Process name: Local security authentication server

Product: Windows

Company: Microsoft

File: lsass.exe

Security Rating:

"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC or server. Lsass generates the process responsible for authenticating users for the Winlogon service. This is performed by using authentication packages such as the default, Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates then inherit this token. http://www.neuber.com/taskmanager/process/lsass.exe.html 

Note: The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same file name:
W32.Nimos.Worm - Symantec Corporation
W32.Sasser.E.Worm (Lsasss.exe) - McAfee
W32.HLLW.Lovgate.C@mm - Symantec Corporation

Click to Run a Free Scan for lsass.exe related errors

Users Opinions

Average user rating of lsass.exe: based on 725 votes. Read also the 631 reviews.

  • 21125 users ask for this file. 269 users rated it as not dangerous. 29 users rated it as not so dangerous. 138 users rated it as neutral. 84 users rated it as little bit dangerous. 205 users rated it as dangerous. 71 users didn't rate it ("don't know").

All comments about lsass.exe:
it works depends and shut down the system at random Altair
Microsoft Local Security Authority Service: Windows critical process for user authorization and loging Martin
windows crashes by the sasser worm. When it is infected it doesn't run neither regedit. anthony
symantec associated the "sasser worm" with this Anthony
Part of the Windows OP system Lisa
As before has been mentioned, a completely innocent system process and a dangerous virus come with the same name. No need for panic but keep your eyes open. Virus removal information can help determining whether you're dealing wtih fake lsass.exe or not. LordScav
PC shuts down the system with code 1073741819  See also: Link Mark
It is required for Win2000 & XP to work. Viruses (Sasser) attack it! Joe
If you have the Sasser worm: abort shutdown by going to run and enter cmd, then type shutdown -a, make sure you update windows entirely  See also: Link thanks
Computer reboots at random, patch helped immediately Robert
When I'm connected to the net. it times me out and reboot my computer Antonio Bell
This file has been causing problems lately... it keeps on "terminating unexpectedly", so the whole computer has a system shutdown in one mintute Githoniel
There was a virus in my pc with the same name. Whenever I enter to the net it infecting in 20 seconds. I cleaned it very difficult by updating windows security and using special cleaners for this virus. Mehmet Ali ALTAN
Lsass.exe is not a virus Sawyer
its either the sasser worm or its not the problem JoSe AnDrEs
McAfee says nothing about this virus creating any file named lsass.exe. It does say that the virus causes the computer to reboot by crashing the lsass.exe process. Subsequent error messages mention this legitimate process as having failed. There is NO need to remove lsass.exe it is a vital system file in a networked computer.  See also: Link Marshall
has a key in registry wich allows ir to reload each time you conect to the net. use a virus removal tool in safe mode and you may get lucky  See also: Link Kalhau
I was infected by Sasser. This file is not reliable. Farid
sabotages Messenger restart in 60seconds error Matt
Error messages containing lsass.exe indicate Sasser-worm. lsass.exe is NOT part of the worm, it's save. Cruel Device
As has been said, the worm exploits a bug in lsass.exe that causes it to crash. Lsass.exe is NOT the worm itself. If it were a worm, it certainly wouldn't be advertising itself by displaying a message with its own name in it. Troy
This is not a virus, the Sasser worm attacks the lsass process and that is why your computer may shutdown, since the worm stops the lsass process from working Samantha
Lsass.exe (lsass) and Isass.exe (isass) is not the same but looks like same...lsass is good, isass is the bad one gunni
I was infected by this 30 minuteas after going on the net Bob
The Windows File itself isn't dangerous, what everyone here is describing is a virus that fakes the windows filename - so lets not get paranoid about every lsass.exe we see... Martyn
Just use Windows Explorer to check the date of the file against other files in c:\windows\System32. If you find lots of files with the same date it usually means it's a required Windows file. Another way to check files is to do a right-click on their name then select Properties and look at the various info listed there. Helvetica
i have done research on this program and i think people are getting confused with sasser virus this lsass is a system program if you remove it your computer is left wide open for an attacker as lsass.exe is a security program to verify computers on your network so dont panic! hackman
In the Windows/system32 folder it is a necessary file. Anywhere else and it's a virus! Caution, Blueyonder will tell you to search for sasser files and if you find lsass.exe to delete it - don't if it's the legit one! id1250
lsass.exe is part of the operating system with file extention .exe.hdmp or .exe.mdmp its part of the sasser worm virus. It looks like its gone when it has not. don't know how to remove it totaly as virus software dosen't. Jon Sasser victim
A default startup process which controls log on security. The following link provides a list of default startup processes for W2K..  See also: Link Die Salomon
If it is a System proces it isn't dangerous, But if the process is in your name it's a virus Myr
Isass.exe and lsass.exe is allmost the same, they can be mixed up and are hard do repair VirusKiller
harmless security file that can crash and cause shutdown, if this happens go into c:\windows\System32 and run lsass.exe to bring it back to life :) Smash
lsass.exe doesn't control security, it's merely used by winlogon to authenticate users. Winlogon will then react on whether the user is properly authed or not. Die, Die Salomon
PC shuts down the system with code 1073741819
causes the computer to reboot! John
It causes your machine to reboot over and over Addy
Authentication service located in various places, but should only run out of c:\winnt\system32. Other seemingly safe locations are C:\winnt$NtServicePackUninstall$, c:\winnt\$NtUninstall*, c:\winnt\ServicePackFiles\i386, or c:\winnt\system32\dllcache. BrianG
Windows critical updates include this file. It is imperitive that you have the latest updates to be protected from viruses/worms/trojans Doug
It's just the same name as the Sasser virus, but it is a f*cking Windows Process  See also: Link Dj Project Ho
This is due to the sasser virus (and variations) attacking the whole system 32. It will cause your computer to shutdown in approximately 62.5 seconds. In the code: the time to shut down - 62.5s is found. Whenever you access the internet certain sites (with http) activate it; then you have the allocated time to shutdown. Other variations include shutdown times of 30s and 124s. The worm is rapidly transmitted over a LAN and replicates instantly. However, the good news is: it is nothing that antivirus doesn't handle. DaV_serveR
I have this on my computer and it's working fine. No problems with restarting or otherwise... Mike B.
because not securty all files palani.s
its reboot the ststems with in 1 min ramesh_2k12000
it will reboot my pc unexpectedly and randomly,without any special reason santiago
Very annoying... Always reboots my computer before the system updates have a change to download! It's a totally new comp too, so I don't see how it could be a virus. xxx
Sasser attacks this Windows process. lsass.exe is not a virus itself, it is shutdown by the worm. help
I don`t know nothing , but I need help getting rid of it
Sasser abuses it. Update Windows often to prevent problems. Kachiko
When i seeee (YOUR COMPUTER WILL BE SHUTDOWN AFTER 60 SEC) simply go to ms dos and type "shutdown -a"........... Naseer
It causes many unvolentary shutdowns, shame on MS? Jarmo
Its just a normal OS file. If you have problems with your computer shutting you down saying there was an error with it...Then you should look into the sasser virus. Once you update to the windows xp service packet 2 you will have the lsass.exe file in two if not 3 folders. All three in windows one in the service packet folder one in the system32 folder and one on some computers is in a folder called SoftwareDistribution. If the file is in any or all of these directories it is fine. Solace
Real windows file (unless tampered with). Love reading others lack of knowledge here on the subject.. Poindexter
i know that i had service pack 2 for xp and when i removed it back to the previous service pack 1, it gave me lsass.exe and services.exe is missing and the screen goes blank viktor vasquez
Seems to keep my hard drive busy Lloyd Plueschow
This file compels the PC to reboot showing one minute alert message. Aatif Ijaz
It reboots your system at any time jami
i've deleted 6 of the same virus in last few hours called W32.HLLW.Gaobot.gen with filename lsass.exe so somethings up Travis
This is not a harmful process Prashan
it works depends and shut down the system at random Anup Deb
Isass.exe (the virus version) will shut down your computer when you just made a connection to the internet for a couple of seconds/minutes. After that, it will give you a warning window, that the computer will shut down after __ seconds  See also: Link Bastiaan
there are 2 proceses: Lsass and Isass (in lowercase: lsass na isass). If you have the proces starting with i -- that's the worm. If you have proces starting with l -- that's windows file for logon :)
Anyone who thinks this is "dangerous" has no idea what they're doing. This is a core security authentication file. Anyone who marked this dangerous is confusing it with "lsas.exe," the Sasser virus. A S
Windows Operating System File, Service Authentication. If not in system32 folder, then it is a virus, otherwise completely harmless, and required to run the operating system. ph
Symantec did not see anything weird. But it sure seems like it's taking up alot of processor power. Also svchost seems to be running quite high Charlie
There is very important that you see in Windows Task Manager\processes is it lsass.exe or lsasss.exe !!! Lsasss.exe is Saser virus! zack
It reboots your system at any time giving me 1 Min to close the application. I have no idea how to correct this problem Jana
Legitimate XP file, is targeted by viruses, is NOT a worm/spyware. Infection of this file is due to negligance of user. Mat. M. (System Developer)
It stop others from viewing your file over the LAN Marc Lesther
Not a worm - Sasser has different filenames  See also: Link Sue
looks it locks and shutdown the pc euge
its normal windows proces... ;-)
threw away my computer  See also: Link jim jacobs
It cause shutdown  See also: Link Babanelos Sakis
Like many other Windows system processes, virii can take the name of this file, however, this file is also an essential file for the Windows OS. The Sasser Worm is the most common problem associated with it. The Sasser Worm attacks the file, and as a safety precaution, Windows shuts down so it can restart a fresh copy of the file. The problem is not normally with the file itself. Updating Windows will fix this problem. Xtra_Zero
It's legit, but could get hijacked if not patched properly and no updated antivirus. Service packet 2 lololol! LouDaman
This file has a lot of flaws which viruses target ie sasser virus. If attacked you will have problems that even windows updates won't clear. Your better off either going into safe mode to run your antivirus then or reformatting Al Hession
The process by itself is not dangerous, but it is easily infected by virus sasser, who has harmful effects. Alberto M. Vernieri (Argentina)
Something to do with windows authentication. When LSASS.exe is corrupted by Sasser or one of its variants, it causes Windows to reboot. From what I understand, anything that causes LSASS to operate improperly will cause the NT Authority Service to reboot the computer. You stop the reboot process by typing "shutdown -a" from a command prompt. Jason B. (illinois)
system file Ciccero
It causes system hangs and shut downs. if you are having problems opening regedit, try booting in safe mode and then going to the regedit icon and renaming it to : regedit.scr : This opens the file as a Screen saver and will open regedit. :) MunkY
lsass.exe...i'm not sure if it is the cause of my .doc converted to .exe file as i save it in diskettes.... sonic
Lsass.exe have the same name then the file in system32 directory. Open the internet, then an error box from Microsoft appear(send the prob. to Microsoft...) then click dont send. A timer is lauch at this moment and you have 1 minute to find something. 1 solution is to fdisk /mbr because if you try to format c:, the worm still on your hard drive. Not dangerous but very bored! Bob
The lsass.exe file is needed for logon authentication and is needed especially in a client/server environment. The sasser virus is a completely different thing, if your computer begins a countdown to shutdown when you open a web browser or when you start up messenger, then you are infected by the sasser worm. Get cleaned up by running AVG free from www.grisoft.com Timmy McTimmunce
LSASS.EXE is necessary for the XP OS. Symantec has a removal tool for all variants of Sasser which I would recommend you run. Before you run the tool, ensure that you have disabled System Restore. Clean the infection (if any) and update your OS by installing or re-installing the latest service pack and critical updates SuperMe
lsass.exe is part of windows OS. If you delete it, or confuse this with a virus, you are retarded and shouldn't be using computers. Check the spelling and it's location people!!!!! not you
Legitimate part of WinXP that sasser worm can exploit. MS site has free check to confirm whether your file is OK or not.  See also: Link Steve M.
Its an .exe file but doesnot harm . It irritates a lot due to abrupt message for shutdown within 60 secs. Rohit
if lsass.exe can provide a shutdown im not so sure. but if than try it with shutdown -a .. only on XP, and not other admin
Lsass is a normal windows system process, but it is part of a very large security hole in windows. You have to download the patch from microsoft to fix it. You can disable the shutdown by running services,msc from the run option in start menu, selecting Remote procedure call, and selecting the recovery tab, and setting all of the boxes to "restart service". Preacher
It makes the computer not able to get to Win (normal & safe mode). Repair or format needed. Michael
It causes shutdown, spreads in the network and generates a huge traffic.  See also: Link Amit Ganguly
it reboots ur computer and disables the internet / network Jens
it works depends and shut down the system at random Mathias Trolle Nielsen
needs windows operating systems .causes frequent shut downs but hardly any loss of data porque
That it keep shutting down the Windows Station... YK93
It also causes my PC to reboot over and over - Windows never starts up Frank
I found both lsass.exe and lsass.dll in my PC. My PC was shut down in 1 mins after I connected to broadband. It displays "lsass.exe terminated unexpectfully with status code 128. System shutting down in ...". Found "W32.Spybot.Worm" and some other Adwares in my PC. The worm also exists in "system32\crss.exe and spoolscv.exe".Symantec gives suggestions to remove the virus Ben
"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. Voskuh
Use KB835732 patch from Microsoft, depending on OS version, find stinger.exe (McAfee) to kill sasser Johan Does
A not harmful process , don't missmatch with lsasss.exe releated about sasser. Édgar
It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token. Arun C (Amrita)
Keeps shutting down computer while on the net. I removed it from windows/system directory and it fixed the problem. shane
just purchased new computer with Win XP.What is written here explains my problem. Never come across this before in older Windows. Obviously a case of looking into the cures posted. Thanks to those of you who bothered. Chas
I found it after I disabled xp`s firwall and alg.exe dissapeared dave
seems to be both a system process and a virus Gordon
This file appears to shut down your computer as soon as you try to run the windows update. Is there another way of running the update without going online irwinhkp
Please help me email to raptor101@swiftdsl.com.au as lsass is in my C:\windows\fonts\lsass.exe and when removed sucks my system James
It kills the internet access and lan security Andriyana Tresnawan
the file takes care of your passwords etc... Mike
The virus forces my system to reboot given 30 seconds within which i'm to save my work, Ibro
if it gives shutdawn window, do this... goto start and run and type "shutdawn -a" and u will be happy
IT'S NOT DANGEROUS!!! system file WHAT?!?!?!
its a windows file the pimpChimP
So far know one has given a solution to this problem.
This is NOT harmful. Sheesh people - learn a little about your computer before you post a message saying this is a virus! Dean
This file name is the title to a window which states "When trying to update a password, this return status indicates that the value provided as the current password is not correct". And about a second afterwards, system reboots without a chance to go into my desktop even to run the shutdown -a command which I've read stops the constant reboot :( So not sure how to get out of this one. And my CD drive is not recognizing any CD, so I can't run a QuickRestore program to put system back to original settings. Any suggestions, I would greatly appreciate it. fernandez
Sasser affects this system file, when no infection is not dangerous Reo
seems like the virus was named after the process to make people wory when they explore the running processes ;-)
Not a Worm just a leech-This File will hang your PC when booting very annoying Herbert Matthews
shuts down computer everytime you are connected to the internet doesnt seem to affect my computer thought when i have windows xp firwall on. To activate the windows XP firewall click on control panel, network and internet connections, My network places(in top left hand corner), view my network places(top left hand corner) then right click on my local area connection, click properties, click advanced and click the little box so a tick will appear in it to enable it. Turn off your modem before you start up your computer to give you time without the shutdown box popping up and shutting you down! Matt
An OS file in Windows XP. Used to authorise logons. Local Sever Security Authorisation Service. For those worried about the virus, simply do not connect to the internet without installing a firewall before establishing a connection! Those who threw away their PC's are a bit silly. Fixes for the sasser viruses can be d/loaded from another pc. Paul
lsass.exe is not a virus. It is a working program of WinXP. My school's network manager even had trouble understanding this and the network security kept calling me to tell me I had a virus. Good lord the incompetence is abundant. NOT SASSER VIRUS
Sucks..I can't get into safe mode, My computer starting shutting down..Now It won't even boot up into windows..Keeps saying lsass.exe error found.. I don't know how to fix it..It keeps shutting down all my virus programs I scan with too..HELP CherryKissies
it is a virus (worm) generated from source code of sasser. i think it is a real danger because i've got it and he produced me some damages...crashed hdd,can`t open my optical drives...that`s all Stan Mircea
firewall caught it trying to talk to s207-81-158-224.bc.hsia.telus.net, I would say it can be misused somehow Al Schemmer
This file is not a virus. If you have any third party appllications or vb programs which calls the windows api's and if the function fails then their will be lsass.exe error adil akthar
when i am in the LAN after a few seconds on my screen apear that error ho said that my pc is shuting down in 60 sec. i don't have this problem when i am connected to the internet. i have the windows 2000 pro operating system and i don't know haw to get reed of this error sergiulic
lsass is a vital system file which can be afected by sasser virus and it causes system shutdown in 60 sec. omjaiswal
Lsass.exe is not a virus benjamin
It shuts down my computer so I changed a setting on my computer and now there is no sign of error now but I am wondering if it will harm my hard drive as it is 1 day old Michelle
I am updating my xp EVERY DAY and just yesturday I tried to start my laptop and at log on, it gives me a lsass.exe-system error message saying that An invalid parameter was passed to a service or function. I update my computer every day and have all the service packs installed. lsasser?
lsass = local security authority subsystem serviece Kematian
Well not to shit like other guys did i will tell u wot exact virus it is in 2 steps ( in forward sorry for my english aint so good in spelling it ) ok 1 step : LSASS:exe is windows proces and u cant work without it and it isnt virus. 2 step but LSASS:exe can be harmed by virus which is taking some part off your internet conection and bombing some who knows where ip, Many hackers send virus which atack yours LSASS.exe and when LASASS.exe is atcked he is no longer your old windows pal he becomes bad and starts riping your conection all wot u can do is format and upgrade only windows to the last Griffit
A fake lsass.exe got into my pc and causes a shutdown after internet communication. It appears as though the lsass service just crashes. Put xp sp2 on my PC and no problems since. Ellwood
Getting on web, about 1 minute later, a system message appears, the pc will shut down in 60 seconds. Additionally the message requests to close all running programms, as active files could be lost. After 60 seconds windows xp crashs. No chance to work on web. alex k.
I don't know what it is but it is taking up half my cpu usage for no reason Hercle
it reboots ur computer and disables the internet / network rahul
Due to this system will shut down within 60 seconds Murty
Critical process for user authentication and logging Read article on Microsoft official site Maham
People who have nagative comments such as "causes computer to shut down at random".. you have another problem. I would suggest trying a better virus program and firewall. This file is required by Windows and works just fine. John
it become dangerous only when it is not in safe hands, since this file is associated with the windows logon authentiction, so if some one gets control over this file its easy for a hacker to get into your system and he can run any script batch file with out knowing you and this is why we several times see that system behaves randomly as if some one is shuting down or closing applications. Hadi
I only know that LSASS.EXE (not ISASS) will be blocked by Virusscan Enterprice 8.0.0 (McAfee) because its a standard blocking role. Its not clear to me why. McAfee seems to think that its a risk file?! Yvo
it shuts down the system in 60 seconds Sad
Shuts down the system at anytime. Mustafa Zulqarni
lsass.exe systemshell, not a virus. capslock
it just restart my pc again and again faiz the great
Use protection, then you will avoid diseases! SivertDaHaX
it works depends and shut down the system at random noman
it knocked out my other computer, and i can't get back in frank cracolice
Nothing except it can cause an error that will reboot the server Jonathan
Hijacks MSN and attempts to spread itself while disrupting Browser and other processes The Illusionist
Isass is nothing but it's a type of sassar virus who can easily removed by any blaster antivirus. rahul soni
Not much, but when the 60 sec thing comes up, go to run and enter shutdown -a. This will by you some time Matthew Smith smitty86ca
vital security process, patch your system and keep your system clean and you won't have the 60 second shutdown timer! Firon
LSASS.EXE does not seem to be a worm but part of network authentification process; check system32 directory it must be in there Andres
when i enter into the net it automatically shut down with status code1073741819. so i am not in a position to use net. and i do not know how to rectify this. mani
This filename is used by some virus (in a different location though) and will be used to execute code. In my case it executed an Iroffer app (IRC XDCC Deamon). Just check the location of the file. If it's not "C:\Windows\System32\lsass.exe" then you should be alarmed! DutchKid
i have reformated my computer 4 times and still have the same problem Jesse
The virus file (lsass.exe) has been cunningly and brilliantly disguised as the system file (lsass.exe). The name of the virus file begins with an upper case or capital "I" (EYE), whereas the name of the system file (lsass.exe) begins with a lower case or small "L" (EL). To an untrained eye, the difference between is visible only if the system font is changed. For more info, check at http://www.softwarepatch.com/tips/isass.html  See also: Link Major Geek
as it is found in the operatining system and also in windows updates it does not seem to be a virus file size is 13 312 byte should be fine SaTeR
Reboots the system at anytime (random) is a the slowing down of the pc is the virus part but the reboot message which u cant cancel is a spyware HHH
if it fails, it makes system crash flyed
It has to do something with the Security settings for the windows vishwas
My computer would not load up to start.. Windows system error file name no found. Had to do a complete recovery with recovery disk and lost all my personal information. Don
lsaas.exe has come up within a virus check and for all everyone keeps mentioned sasser virus this has identified troj_delf.db as the virus. Tracey
system shutdowning
sure wish someone would just say it in lay man's terms how to get rid of these 'timeout' and computer freezes. DJA
This file is just for the graphical interface. Jasper Wammes
its not so dangereous. Hit the internet connection properties and enhance the firewall if you use XP. And the problem is over.. Ayhan
This will shutdown the system with error messege system32/lsass.exe,so u need to go to cmd and give cammand as shutdown -a then it wil stop the system shut down so u can download the security taskmanager and run so that it wil recover this error ranjith
Windows System file...when u`ll see again that shutdown message just go to Start- Run and type shutdown -a Puffi
its just puts unwanted files in your local disk jimmylfc
it shutdowns IDE of Microsoft Visual InterDev
It's a system file using for logon process Dinesh Sanas
"C:\WINDOWS\System32\lsass.exe" is not a virus/worm/adware/spyware. "lsasss.exe" with the extra "s" in any location is dangerous and should be deleted as it is related to the Sasser/My Doom worm. Preston Mathis - Certified Computer Engineer
there is a lsass.exe error,LSA Shell Hettiarachchi
PC is in a constant reboot cycle - LSASS.EXE - system error "When trying to update a password, this return status indicates that the value provided as the current password is not correct" and then reboots. Cannot F8 into any startup mode without getting this error - safe mode, command prompt, ect. Pastor Don
It just shut down my system after showing me acountdown for i min. flat. V.annoying prashant
It is an essential Windows Process, if it encounters an error or is terminated your system WILL shutdown after 60 seconds and I know of no way to stop that from happening. There are malicious processes under the same name, sometimes you can tell if they're fake if they're under a user name other than SYSTEM. Some viruses also infect this file, but it IS an important Windows component, so don't "fix" it by attempting to delete it. Update Windows to prevent it from getting infected, there also may be an update that fixes the infection. Anti-virus programs should now fix problems caused by Sasser Maccam94
OS file in Windows XP/2000 as long it is localized in /system32... If not, probably a worm or worse: Sasser! The problem (for the OS file) is to let him outbound to internet or not... Kusanagi
I blocked it in Zone Alarm (access & Server)...no difference Richard
WTF people, it's killing your machines and you don't even know it!! prophet
legit system file but vulnerable to attack - so use firewall jumbaya
when connected to net it shows timer of 30 seconds and shuts down  See also: Link Vishal
this will shutdown my pc without asking to me. Nitesh
this shuts the computer at random and I have to reboot manually. 4 months I have it moulaf
This has been affecting my PC lately by subsequent shutdowns. As soon as I try to connect to the ineternet shutdown takes place after a warning message within 1:00 min Udaya
lsass.exe is harmless, its been said hundreds of times, Its a system process for handling user logins, if u think its a virus or some other danger to your PC, end the process, but you will need to reboot after you do because it will crash the system. And you cant say Isass is suceptable to viruses because every file no just system files are prone to virus attacks, so get over it. Its harmless Si UK
it disable MSN messenger & make system busy black
is a spyware Rick
Interesting it seems to be infecting dvrs and is pair with a mpr file John
I had what appeared to be the Sasser Worm, but my system checked out clean. Norton, McAfee, et.al. all gave my system a clean bill of health. After a week and a half, of everything from doing a system restore to an earlier date to doing a Windows repair, I found that my local c:\windows\system32\drivers\etc\hosts file was very obsolete. There is no good reason to have something other than the default (localhost definition) when on a network. Restoring the file to factory values, cleared up my lsass.exe, userinit.exe, and svchost.exe abort issues as I connected to the correct network servers. Lou
if u need time to work on your computer before it shuts down go into the date setting and put it a couple of days back. this will give u time to work on it AB
It affect logon G Patterson
It's really dangerous when is infected 101
random shut down. this should be either updated or deleted using a virus scan or an advanced spyware scan. it will completely destroy your operating system. so bad that it will not bring up your desktop or any application you may want to run. KRYSIS
It won't allow me to access my system. I have an active Norton 05 running on my system. X
At random encounters (about at least once in 20 minutes, but mostly every 5 minutes) it keeps my system BUSY by drawing 80% CPU load on a PIII-866 running XP PRO. That makes me angry, because that interrupts file transfer for 1-3 minutes (CPU can`t handle I/O's in that time). Sometimes i can set task priority to LOW (that helps), but most times i get an "access denied". I think, this is still part of the XP OS, but IT SUXXX MAJOR COCK!!! Schnitzelfisch
it is a virus
Extremely dangerous. Delete it and all other files in C:\Windows\system32\ or else your computer will spread viruses everywhere.
ive reformatted my computer several times and this virus keeps popping up. as soon as i get my machine booted into windows this thing trys shutting down my computer and een after i remove the thing with a patch it keeps me from installing new software and all kinds of crazy shit. if someone knows where i can find out why this is happening on my machine please post it. kirk
I feel it is a file which affect RPC and shut down the system randomly Trimay Prasad Aryamishra
i seems that when it krashes and tries to restart that it also removes documents folder in my computer and name in start menu. Andy
It starts rebooting immediately when I get connected to LAN, but it's not lsass.exe fault, the worm it self causes the close down Wild Finn
This filename is used by some virus (in a different location though) and will be used to execute code,windows\system32\lsass.exe terminated unexpectedly with status code 1073741819, system will be restart with in 60 second K.DHARMALINGAM
It's not a virus! It's essencial for nt platforms... splash_
LSASS.EXE or lsass.exe (Local Security Assistant is system file located in C:\Windows\Sytstem32, whereas ISASS.exe or isass.exe is the virus file
Deutsch: Also, der Prozess lsass.exe ist in Ordnung, allerdings muss man drauf achten, dass es nicht Isass (mit großem "I" am Anfang) also Sasser ist. Wenn der PC herunterfahren will, einfach auf Start, dann auf "Ausführen" gehen und dort folgendes eingeben: Shutdown -a English: The process called "lsass" is OK, but you have to check, if the process is not "Isass" (with a big "i"), because this would be "Sasser". If the PC restarts, go to the Start-Menu, then start a new Process with the following text: shutdown -a NeoXC
This is NOT a virus. Lsass.exe, a perfectly legit running process not doing any harm. isass.exe, takes advantage of a security vunerability and causes Lsass to shut down your pc. Like others have said, just type "shutdown -a" in run to stop the virus shutting down your pc. Bladerunner229
windows process, no dangerous
I found that by using 'Stinger' the prob was fixed. I had the Korgo.worm and its that which uses flaws in lsass.exe and RPC to shutdown your machine. To terminate the shutdown, go to RUN and type CMD or Command. then type Shutdown-a.  See also: Link ..:: AvIzOnE™ ::..
OK - I have been experiencing problems for a couple of weeks. Have built up another computer with same spec's as faulty one and put on same network. When firewall reconfigured to send port 80 stuff to new machine, new machine started shurring down with isass.exe code 128 errors. The older computer which was previously shutting down now works fine. !!! Have noted that immediatly before shutdown packets are received from the net. Could there be some form of Hack that is creating this problem. DougCooke
It is confirmed that the lsass.exe file is infected with a worm, probably a Sasser. The lsass.exe is a System process file, but you cannot expect a system file to notify you that the system will shutdown in 60 seconds, its ridiculous. I have run one of the Symantec fix tool, but the issue persists. However, there are other variants also, but i couldnt try those. When you receive this alert, type Shutdown -A at the Run box from Start menu. This should help you. Bimal K.P.G
Said lsass.exe was missing, then asked for password.. problem is there was never a password to begin with. 2nd time with this problem. First time we did a clean install, same with second. Should I expect this to happen again, and is there anything I can do to permenently lose this problem. I have a current anti-virus and xp firewall. I connect to the internet through a wirless router. How did i get this and is it the sasser worm? N8 Ting
What i dont understand is everyone wants to argue, its a virus, its a system file, but the fact remains, i still get the error on boot and how do i correct it. if you dont know, why post your comment unless asking for help. i am looking for info like, restore from the repair option off the system disk or copy the file from another computer to the system32 directory, anything but mindless talk with no solution. rude1
lsass.exe is apparently modified by a Trojan Horse named TROJ_HOLAX.C. This seems to be a new Trojan which is not known either with microsoft oder any of the common Antivirus Programs. In my case it was quarantined via TrendMicro but, anyway it affected most of our servers. The lsass.exe is shutting down my systems, I didn't find a solution yet. I would be grateful for any information Chris
turned up in an error msg when installing XP. System seems to have hung on installation after viewing this error. "The application or DLL C:\WINDOWS\system32\SAMLIB.dll is not a valid windows image. Please check this against your installation diskette" Mickey
at the end no one answered the damn question. of this stinking lsass.exe, I have the same thing happening to computer ever at starting to boot with a disk, it tells me that there was an invalid parameter was passed to a service or function ME
This file is created due to infected by virus.The system warbns you you to savethe files and it will be shutting down in next 60 seconds.Though bnot dangerous it makes me feel irritate when i am in mid of some important work. mukesh agarwal
When i try to get back to windows it comes up with system error Lsass.exe and below it, it says "insufficient resources to start API" how the hell do i gt rid of this so i can get back on my computer? NEO
When i try to get back to windows it comes up with system error Lsass.exe and below it, it says "insufficient resources to start API" how the hell do i gt rid of this so i can get back on my computer? NEO
if your computer begind to shutdown go to run then cmd and type in shutdown -a and it will stop it but only do this while you are virus scanning or it could leave the virus on your pc BIG G
my current problem is, that my computer wont even restart. It only shows a black screen after rebooting and tells me that "isass" couldnt been reinstalled..is that the worm too?:( Sevel
I am facing lsass.exe problem from last 2 month if and one know how i can resolve from lsass.exe problem please tell me at callingtomanish@yahoo.co.in mack
Very difficult to remove, because is part of WIn2K system =S. That's why, use Linux, Solaris, MACOSX, uff, everything but not windows..... josue
This is really shit it just reboots ur computer when u go to the internet and my symantec cant remove it and not even my virus scanner!!! IG
My lsass.exe is not a virus (I have sp2 and Norton), but the problem is that it works continously, accessing the disk. How can I stop it? Jacob
Just having the same difficulties that everyone else is on here... its "unexpectedly terminating", and shutting the comp down God Cheese`
This FIlename is used by some virus & due to this the system shutdown rapidly and also no network path is found Gunjan Pandey
Not a good file to have, but dose host a home for viruses occasionally, quarintine and see if you can remove.  See also: Link Aaron5367
it shutdowns my windows and restarts thus creating a great problme when i was in a important work Kiran
Have a question--lsass.exe is in my c:\i386 and in servicepack and in system32...safe or unsafe? tex
jiganamah virus ieu mah, soalna komputer win2000 server urang restart wae, keuheul pisan. Indra Sukmayana
it shuts down system randomly and destroys exe files of othe applications Afolabi
System restarts frequently and does'nt creates the network connections Gunjan Pandey
lsass.exe is apparently modified by a Trojan Horse named TROJ_HOLAX.C Chris
if it is anywhere other than windows /system32 remove it BG69
Help me! its completely destroyed my computer! BEWARE!!! Isass is evil...
if your computer begind to shutdown go to run then c
computer go pzffffff when it turn off  See also: Link
it doesnt make the computer to boot  See also: Link Lokesh
I think it's on my computer... SARSSER
lsass.exe is not a virus Jacob
Einfach mal googln'...  See also: Link noname
there are TWO files that look the same Lsass and Isass. Lsass is the Windows exe and sits in the C/Windows/System32 folder, and isass oftern goes to the SYSTEM folder; C/Windows/System. Use View/Details to place files in an alphabetical order and ONLY remove the isass (Because of default fonts you must list the files alphabetically. To remove usea programme like Gipin Softwares Move on Boot which will remove ANY file that will not delete. Mostly you do not need to reboot. Once you have selected delete on next boot the file can then be right-click / deleted immediately  See also: Link JMR
There is also another file named "lssas.exe" Pay close attention to the spelling of filename......anyway i go into taskman and end all process that i don't want anyway......this is one of them. sometimes runs multiple instances at the same time as well so make sure you "End Process Tree" for both if they appear......I HAVE NEVER HAD A PROBLEM LEAVING IT OPN SYSTEM AS LONG AS I END IT AFTER STARTUP!!!!! Also run task "msconfig" and you can choose not to have it start with windows :) Roger
Put in a firewall to get most of the problems fixed. Or use the Windows Firewall, it is present in pre-SP2 also, it is named differently. Use Stinger from the McAfee site. Then use Ad-aware and spybot, it solves other issues also(If your system is affected by this old a virus, it will be affected by spyware also. To get the run command without using the start button, use the combination of the Windows key and 'R' together. Then you can use 'shutdown -a' to abort the shutdown.  See also: Link Brainiac
I know that this file is properly referred to as Lsass (and I know better than to refer to it as lsass.exe w/ alower case L). And I know that isass.exe is a malware file which is NEVER to be referred to with an Upper Case "I" (i), which is indistinguishable from the lower case l. (L). If all who wrote about these files consiistently used Lsass for the Microsoft file, and isass for the malware file, much pain and confusion would be avoided.
Very dangerous virus no matter what anyone says. It is both a Windows process and a virus so it can be misleading. It has wrecked one of my computers and has forced me to format another. If you ever get this virus, your best bet is to make a parallel copy of Windows (if at all possible), then copy impotant files onto disk. Afterwards, format your machine entirely. It has come back twice for me and it's a load of trouble. A Person
i am using windows 2003 server and having problem with lsass.exe and shution down the server within 6x seconds then i have set the permission this file to deny to admin then i restart the system but system could not restart it is hp server ML 150. how can i get it back my system any clue? plese help me to allemirra@yahoo.com allemirra
this is the vuln that the sasser 445 and 139 attacks. also this image name is commonly used in many rootkits and backdoor servers. just have a good av and firewall installed and you should be fine although having said that i have got past norton security recently with this vuln with rBot. So be carefull. :-) Ownsya
there is a difference between Lsass.exe and Isass.exe. well its actually 'lsass.exe' and 'Isass.exe'. but while the first one is typed with a lowercase L, the 2nd is with an uppercase i. which looks the same. the L one is safe. don't delete it. alfred
It is a virus or trojan or whatever it is, it must be annoying! No, doubt! I got my Windows shuting down in countdown of a few seconds, while I was starting connected to the internet. May Al-Karim always protects me from such disassters!!! kuki_furuya
This file seems to be hogging all CPU, when I go into task manager it is using 90+%, So IE slows to a crawl, anyone have any ideas? I installed XP only about two weeks ago and it worked fine for the first week Thanx Josh
Thank you ..:: AvIzOnE™ ::.. Though I've thought this may be related to the PRC thing, I didn't think that they're directly related. My problem is that whenever I start MSN it will terminate wityh status code 128.  See also: Link
don't confuse a lower case L with an upper case i when looking at the file names as one file is a virus and the other is a windows os file for security. this is a clever trick to hide the true file name Halgasm
It disrupts my cool computing by shutting down at random. I found it 's a worm that attacked one of the computers on my network. After dealin with it it has not come back worlay
Well if it is not running from the System32 then it is the sasser worm, as long as its running from System32 it is harmless, all it does its validate Windows User Logons Tim
Your machine does not need to be infected for you to receive a shutdown message from lsass. Its a sign that a remote process is doing an attack against your PC.  See also: Link Tommo
it is actually a system file used by the Windows System being exploited by Sasser , a variant of Plexus, that restarts the PC every few minutes. Edsel
virus is having the same name as this file.. that is confusing and dangerous for the users. may be virus using this service too Gaurav Julka
it shut downs my pc by giving waring before 60 seconds automatically.how should i overcome this problem, can any one suggest me lokesh
I have just got the virus it just shuts down my pc after a minute countdown and gives lsass.exe errorcode 128 Moagi
It shuts down my computer with a 60 second warning. Download of direct x failed at 99%(dial up) Macintosh
I think this is a virus, it's slow down the PC and call RPC to shutdown the PC in one minute. Chandra
i think it is about system secrutiy on ethernet card, or other card's configration error. cüneyt uğur
used for user authentication, but i automatically shutdown the system at random mathanraj
this file is very crictical it just shuts down your computer very quickly dia
use RUN command and type shutdown -a to stop RPC block ports 135, 445 Death by sin
OK! I understand it's not the virus, but how do I get rid of it?!?! chad
causes system to freeze, roboot over & over. c/c roms will not read
it shuts my computer down within 60 sec. :( i hate windows :D KruG3R
i cant find it in any folder or system32 folder or anything.. bob heinbokel
everytime i start my ie, my computer shut down in 55 sec. anti-lsass
Isass.exe is a worm, and Lsass.exe is Windows native Joe Zhao
randomly gives me an error and restarts my computer stephen
This isn't a virus, is worse, is a windows file!!! Rogelio
it is from Microsoft. It keeps reading and writing Ning Cao
I believe this file would be a window process Private Ryan
I have bee facing same problem a you  See also: Link Paul Martin
its is very danhgeroiusprasjesh
cause shut down in 60 secs rr
it is not a harmfull file Ahmed Mamdouh
Not a VIRUS Joe
i am infected with this worm sasservictime
it is a bad one... it lurks within your network... tip: when your frustrated... before reformating a networked pc... kindly pull off the lan cable first.. to keep it inside and keep others out. JC
Repair for error that stops you from booting from this system - not virus program is knowledgebase 307545 at microsoft  See also: Link Ron
Isass.exe is an upper case i. lsass.exe is a lower case L. Virtually indistinguishable huh. More and more harmfull stuff is being sent out with window file names, using1instead of l, I instead of l etc..... i would advise you all to set your default font to sans serif or any font which distinguishs between letters. isass.exe is a trojan loader, very very bad, Lsass.exe is the usedr authentication process, harmless but isass.exe buggers Lsass.exe so eventually it fails to reconise internal passwords and prevents your OS from starting. I've just thrown my laptop out of a 6th story window. Mekatrig
this virus is so dangerouse and make me to waste my time seraching it's solution muse
it keep rebooting my system after some fiew minutes. this happens when i connect to net. i have just reformatted my PC but still having the same problem Buto Man
For 2 weeks i try to fix it. i formated my PC for many times. isass.exe don`t let you to use a firewall or a antivirus. I don`t known what to do :( Ionutz
shutdowns my windows and restarts . I'm very engry. I have Bitdefender, I have a good firewall, a good Spy, and it continues to restart my computer. Foga
Everywhere Claims It To Be A Windows App, But When I Didnt Block It From The Net, None Of My Internet Required Applications Worked. UnEmploymentDude
it a very troubling exe as it frequently reboots the computer girija
It is a SYSTEM file, which is absolutely not harmfull it self. however multiple virusses abuse functionality of it, or render this program instable. This has caused a lot of fals alarms!
my computer cant boot!!it keep on saying missing lsass.exe!! law
lsass.exe is not a worm or any virus it's a os program file but sometimes it can deactivate from services rpc pawan srivastava
It's a system file. What are you going to do; delete it? Lsasss.exe (the virus) has an extra s on the end LEAVE IT ALONE
Download stinger programm to remove the virus  See also: Link Smeik
It's a security update for outlook and windows I'm not a prmotor for norton but if you have good security set up programs like trojan guard, zone alert or norton you will not be infected by sasser or any other virus Alucard
When the system prompts shutdown, go to the right hand corner and modify the date by one year. the message will then show you that your computer will shut down in 365 days. now you have a lot of time at your disposal to think about the problem. Arun
lsass.exe is not a viru. However, it may have a Trojan virus attached to it. W32.SPYBOT.WORM CAN ATTACH TO IT. Norton and Sophos will not remove it directly. Reboot into safe mode scan c:\windows\lsass.exe if trojan still there Norton should then remove it. Tony
Read the note! c:\windows\System32\lsass.exe is not a virus. Other verisons of lsass.exe (different directory, different capitalization on the file name) probably are. We are talking about the windows process in this web page, not the virus! Kat
I recently had an encounter with this lsass.exe with my WinXp. Then after 60secs, it will reboot my Pc. I did a reinstall of the OS. What takes place now is that when the shutdown process as initiated by NT AUTHORITY\SYSTEM occurs, my Pcs dont reboot at the expiration on the counter but all other drives like the floppy, cd will cease to work until I now I shut down and restart the PC. emmanuel
This file is not the problem, the problem is a worm that has infected your computer. I did what I was told to at the site that I have linked and my system is functioning normally again. Good luck.  See also: Link Matto
Lsass.exe is a file which starts a process responsible for generating an authentication token. Its not a virus. A virus ( idont know its name) hinders the token , and authentication fails. Therefore a restart is initiated by Lsass process.  See also: Link Ankit Saxena
I Solved it to install sp1 and i guess this reason is about some trojen or virus come from internet when i look crack :) Cüneyt UĞUR
r u tired of all these advices... i was ;) erni
The file lsass.exe in windows\systems32\ is infected because this the windows service and the anti virus products is update little so that most people have one kind of virus hyde
If your computer keeps rebooting due to lssass then go to the symantec website and download the sasser worm removal tool. It worked for me. Dinger
When I had norton I didnt know that this file existed, I uninstalled Norton & installed Avast and since then Avast has been blocking it. Charmaine
Honestly people, it aint a virus, Do some research on computer files and find out for yourself. Do not believe what you read on here, some are true some are not. If you get a message reading you computer will shut down in 60 seconds. download the tool to get rid of it. GOD
-it roboot my com without notice if im playing games... vbnmgjk
as fromt the top of the page here :-- lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token for them that says it a viruse are scare mungering, yes if it fails ur pc will shut down,  See also: Link Shalianahe
Vital for windows. Very rarely causes a lot of disk activity , but I think it's nornal.
It is a windows system file. It random shuts down the PC which causes loss of valuable data. Bother the users. Destroy CDs/DVDs in Burning situation. Needs immediate solution for all OS. Zafar Alam, SMWT
I hv experienced first time, it is very dangrous when u hv to save many files, a lot of data can be damaged. Aamir
Lsass.exe ís obviously a windows process. But the vulnerability of it makes it dangerous. isass causes annoying problems, like not even being able to start windows. How can I fix it when I can't get windows to start (not with a system restore or in safemode)?
thank god. not a key logger Gerard Way
it randomly rejects memory and shuts down computer. Lisa
it force system to shutdown Ozan Dogan
some time virus like this (or not) shutdown my computer automatically devotee
Legit file / process however, if it's been infected or replaced, even a new installation impossible as you cannot even generate a working OS Shell to login to. Apply the necessary security updates and protect the file from infection / replacement. I have a copy of Win2K Pro and the install copy has an infected lsass.exe file so you can't even install it period. Scooter
Hi, i started having this problem awhile ago but never go the message.... it just kept restarting as sonn as windows loaded.... i tried a fresh install and i cant finish it as it keeps giving this message... what can i do :( any help is really appreciated alien13
System security logon Jordan
This problem is about trojen you can solves it install sp1 for 2003. and you can use this command on run "shutdown -a" to prevent shutdown Cüneyt Uğur
If broadband cable is connected then only this "Lsass.exe error windows shutting down in 60 sec" error is coming since DNS server trying to login our PC for verification and our machine is verifying login user this conflict is happening. Still I am searching solution for this. Ramesh N
its a critical windows file but some time infucted with trojan. you have to turn of the system restore for root disk partation and then restart the PC and during the restarting keep press the F8 and chose the " safe mode" and then run your antivirus scanner and also microsoft anti spyware to clean infacted files. Salim
well this file or .exe is not so dangerous as it is considered, before coming to a conclusion we have cheke whether the lsass.exe is runing or not that local security authhentication server,after that chk it tin the c::/windows or c"/winnt. sanjeev
The lsass.exe is a genuine part of the Windows XP operating system. It is neither a virus nor is it harmful. That doesn't say that someone either has or hasn't figured out how to misuse, or potentially abuse it. Most criminal hackers will do anything to harm or damage a users computer. But, the basic files and programs that come included with MS Windows are harmless.  See also: Link netaces2k
I only know what I've read here. Not much inf. Ken
It forces a shut down on your system when connected to any intra-network Ape
it is a file required for networking purpose in win 2000 and xp but is sometimes overwritten by worms n trojans in the same name lsas.exe located in c:\windows\system32 which then affects system's performancemakin it unstable. When the file is overwritten by worms for example BLASTER it fcontinuously fres error regarding REMOTE PROCEDURE CONTROLLER and makes stystem to shutdown in 60 seconds. do contact me for further queries pratham4u2002
forma part del sistema macbord
some virus got attacked.so my system gets shutdown in 60 seconds some times. ujwal
thaught it was virus but is something to do with logins harrister101
cause shut down in 60 secs chandan
*sigh* People, it is NOT dangerous. It is a system file. Try disabling it in Task Manager and just see what happens. The Sasser worm has a different filename. The shutdown is probably a corrupt registry key.  See also: Link Kisara
The lsass.exe fille which is mentioned here is an important windows file. As long as said file is located in c:\windows\System32\lsass.exe it's the real file. The lsass.exe which shuts down users PCs is the W32.Sasser Worm. To prevent this problem, download and install the KB835732 patch from the microsoft security bulletin MS04-011 page, & enable the firewall in your network connections.  See also: Link Mechpaladin (Vernon Chan)
If this file is corrupt our AD is corrupt .Imagine your are working on server and all of sudden you have error"your server will rebot in 5..4..3..2..1".bang.In that case we need to repair it refer KB258062
is not so dangerous but still doesnot allow u to work properly sendil velan
Lässt Explorer abstürzen Eierschädel
Lsass.exe file is a virus and Shutdown Systems Automaticaly. I have already faced this Problem. My OS is windows 2000 and Used shutdown -a but it not a suitable with Win 2000. System Restart after 60 Seconds. so I am not able to work on my System. Ritesh Bhardwaj
it restarts the computer after few minutes gurpreet
I dont know much.. But its a REAL PAIN when im working , and it says i HAVE to reboot my pc due to an error or something, im getting close to calling microsoft about it, Its driving me mad, Paying $300 for windows 2003 and getting errors and other stuff Syflop
do not know about this file but some dumbos like me thought it was the isass ( the one which begins with i not L ) but wasnt. john Doe
problem at startup uday
i kno that it restarts your pc and only gives you 60 seconds to save everything Andrew
DO NOT DELETE! removing this file will cause windows to stop functioning it is required for security authentication, if your machine is shutting down chances are you have the sasser worm, see symantecs website for details on removal Brendan
security while entering into network Samuel Devadoss
Appears out of now where, Good firewall will stop it. Knute
Its dangerous when you got a blaster worm, when ever you go to the internet lsass initializes a shutdown of your computer. Filip Baba
Just a windows file. If it reboots your PC you are infected by a virus (also if you have a new computer, you just need to connect to internet to get the virus)
when browing it logs you off and reboot the system FEHINTOLA SOBUNKOLA
local security server Abhishekmathur
some spyware removers can order you to remove lsass.exe. Only do so when it is not located in win\syst32\ otherwise windows wil not start the next logon. d.
It'll completely disturb my work and will always shut down every system that i'm using. I'm a freeters that usually working with the computer and this worm cannot be removed or deleted as i've tried before... At the end, I need to reformat my computer and reinstall all the software i want to use..
Window system file. Not a problem! RedRiver
LSA Shell (Export Version) has encountered a problem and needs to close. We are sorry for the inconvenience.
It is very irrtating. As you go online, after sometime, the reboot dialog comes with a time span 60 seconds. Thing is you can't even terminate this app. I am using Win 2003 server, someone suggested me to go into COMMAND mode Use command "SHUTDOWN -i " and set the time = "99999" but I found out the "OK" button Grayed out .! 11 Jordi MannSlayer
Important windows process. Only gets the shutdown notice occassionally when the virus tried to get in.After rebooting works perfectly fine for about a few months Leow
I cant log in to my computer it says It is missing Lass.exe and when i click OK it restarts. Sydney
The "System error: LSASS.EXE" error may occur because the OOBE cannot reset the Machine registry key before the computer is restarted.1. Start the computer with a Windows XP CD. Enter the recovery console by pressing the R key, and then logging into Windows. Doing so opens a command prompt. If no administrator password exists, press ENTER. 2. Type the following at the command prompt: cd D:\i386 3. Press the ENTER key. If the error "The system cannot find the path specified" appears, enter the following paths, in order, until the error does not occur: cd D:\Windows\i386 cd C:\i386 Michael
This is not a dangerous dll, it is necessary for the Windows operations system. It is not to be confused with the worm, which looks the same. Look: "Isass", "lsass". The first one ther is in fact a capital "i", not a lowercase "L". If it is spelt with an "i" (or any other letter, for that fact), it is the worm, but if it spelled with and "L", then don't delete or stop it, it is nesessary. Ryan
it is not a virus or any. this is system file this problem is windows file (lsass.exe)file is unable to process, or the file function is incorrectionly some causes.causes are I don't no. Phaneendra
I am a CompuITA Certified Virus Inspector, this program is not a virus Xwassac Studios
runs ping.exe multiple times and shut downs the computer where i do cmd or msconfig or regedit No name
the file "lsass.exe" is NOT a worm. "lsasss.exe" IS a worm called the sasser worm which takes advantage of the vulnerable lsass.exe process. do NOT stop this process i know all
I have no problem with this file in Windows XP. However, on Windows Server 2003 with IIS installed, this thing keeps restarting my dear little server, which connects to some twenty clients. It's not a virus. But there's a bug inside which brings up the problem. Teehee
ISASS.exe: An invalid Parameter was passed to a service or function, How can I solve this problem? Masud
It constantly uses the 500 UDP port,, could anyone please tell me if this behavior is correct? earamosrico
It appears suddenly and it shutdowns my system within 60secs and when my system reboots it again reappears and says it will shutdown again.I am fed up of this and I formatted my system completely. Its definitely a dangerous virus.Make sure to stay away from this harmful virus.It is definitely a virus only as no system file will ask you to shutdown abruptly within secs again and again. Naseer
if it keeps happening just create a new batch file with this code: ":START" (newline) "shutdown -a" (new line) "GOTO START". then run it and the computer wont shut down Josh
shutdown randomly(winXP&win2k) - 'windows\system32\isass.exe' terminated unexpectedly with status code-1073741819 -just need to update ie n run windows update atokfly
If you find a PC that has a clean copy of the lsass.exe and msgina.dll, copy those files and overwrite them into your windows/system folder...problem solved. David
It is a windows component but when infected it causes much trouble shutting down PC automatically after 30 min. period, process closed by NT/Authority it's still giving me trouble I have Avast! Antivirus and have run the patch in Windows, still not removed it might be some kind of worm called blaster or sasser but cant clean it yet, I consider it's dangerous. Edward R.
It's a WinXP vulnerable procces, he can execute remote functions, it get's infected by trojans. Can be fixed by updating windows Borz Sergiu
we have experienced this issue in win XP, for the temporary solution, we give shutdown -a in the cmd prompt, how to troubleshoot in win 2000 prof. Dayanand.J
this file lock your computer if u leave the computer for more then 15 minuter.then u must restart. if u r adminstrator of the computer Iftikhar aziz
Don't confuses Isass.exe with Lsass.exe, under the right font they look the same. "I" is the virus "L" is a real system file Rissacher
This is the Local Security Authority subsytem, responsible for authenticating users on your system. Services such as Net Logon and Security Accounts Manager use it. Maur
whenever i connect my ethernet cable to my pc, an error pops up with some error code which shuts down the computer within 60 seconds. bapin
This file is not a virus. I think virus is isass.exe find it first. Rubel
This is system file not it is used the xp if we can't be deleted and it self replicated file so don't delete it if it runs pls run the command Shutdown -a it shop the lsass.exe then you logoff the computer and the shutdown it Pathan Nisar
I'm infected with the Isass.exe worm. I'm not even able to log into my user, so how can i remove the problem by scanning it since i can't even start up any programme. Please, i need help here. Madison
To my knowledge, lsass.exe is NOT dangerous. DO NOT DELETE IT. I was infected with the sasser virus, and I deleted lsass.exe to try and fix the problem. Well, all kinds of hell that caused. The computer, when started/rebooted, simply gave me a black screen. As cute as that may sound, it's kinda annoying when you can't get into the computer at all. Remedied this problem by fiddling around a lot, installing a new trial-based version of Windows, replacing the file and deleting the temporary OS I created. I would reccommend NOT deleting that file. Rather, open 'RUN' and enter "shutdown-a". spirokimino
Everyone with arrow all the way to the left has a clue, any where else, you're confused....(c; PLY
When I got isass.exe I ran a boot time scan from "avast antivirus home edition". So far it has cleaned the virus out.... I recommend Avast Home Edition (free) because of the capabilities of a boot time scan. You can download Avast at the link I have included.  See also: Link Caleb
only what i read tonite and the last time i tried to log in i got a warning someone had accessed some of my files steve
Creator = Microsoft / Windows = Local Security Authority Subsystem Service Arnco HELMI
Freezes windows xp sp2 when running mcafe 8.0 enterprise memory scan Arturo Lorenzo
lsass.exe not a virus.its a molwer or spyware.if can be remove by any antispyware software of antivirus.
This is the local security server, it's not a frigging virus, by it or any other name; it is REQUIRED to run your pc, if you get the message that it caused the system to reboot, it is because the sasser virus crashed lsass and your PC is rebooting as a result. IF YOUR COMPUTER REBOOTS STATING THIS YOU HAVE SASSER.
Local Security Authentication Server Win NT4/2000/XP/2003 verifies validity of user logons to PC/Server Important part of OS path is C:\WinNT\System32\LSASS.exe (WinNT/2000) C:\Windows\System32\LSASS.exe (XP/2003) Williggin
it has password and login info in it,,and it accesses the net,,its prohably needed but i can see exactly why the lsass virus targeted it dan
LASASS.EXE its coming with the windows xp , 2000 ... so its not a virus but its better to block it by the firewall and its ok mirna
A system File, (incase you didn't read the previous million posts) not dangerious, but essential, confused with isass.exe by the sasser virus, it you have it then download a anti-virus program to get rid of it such as Avast free, avg free bitdefender etc. Also, make a batch file with shutdown -a in it and then put it as a quickkey, so that it will not shutdown durring the virus removal Linux For the win
It restarts when u run .exe files especially antivirus software and .txt files. UTP
Authentication process apparently requires disk I/O every second or so 100% of computer "on" time. It's a hog. It shouldn't require so much resource. john
Is required to make an internet connection. If you stop the service it will timeout and restart the PC for security reasons!
isass.exe or lsass.exe 2 different things but people think that is the same that;'s why is so many problems  See also: Link mrsiwy
lsass.exe is a SAFE and required Windows security process, do not get confused between this and lsasss.exe - which is the sasser virus TeeJay
lsass.exe can hide elements of W32.Virut.A & PE.Virut.A. It will appear as IEFilter.dll & process 236. The best defence is a recent mirror backup, because it can also corrupt safe mode access. Astrocom
i have this on my computer and there is no problem with rebooting at all or anything. Kristin
strange process, seems to be killed at random if there is any winxp system in the LAN, zonealarm solves the issue, but not the problem Stelf
You will regret deleting the file if you choose to delete it. It is safe by itself. Get a Grip
leicht rauszufinden ob Virus oder Windows :). Einfach suchen wenn es in Sys32 is dann is es normal wenn sie woanders ist löschen ^^ dust
LSASS.EXE (c:\windows\system32) is a part of Windows; ISASS.EXE placed else is a virus Peter
This can be exploited by bots remotely and can hide the trojan process from being displayed in windows task manager, Resolution : update SP2 and ensure you kill all unknown processes using Security task manager! Keep safe! Alex
Some one says it's a Virus, another one says its a system file. So I did some research, and found that it's a system file. but I'm getting crazy from my mcafee telling me "Trojan found" if I say "Delete the infected file" everything will be fine, however the virus comes back if i go back to the internet, Please Help Berry van Zanten
LSASS is a vital process, but watch for the file "isass.exe", this is a trojan. Intruders try to make this file look like the original Lsass Paul
sometimes viruses tend to diguis themself.
well i know its on every computer made by microsoft. this cant be a worm. or it wont be on your brand new computer, its a worm gary
it comes up on startup then when i go on the internet I just delet it ronsolostar
The Lsass.exe process is responsible for management of local security authority domain authentication and Active Directory management. This process handles authentication for both the client and the server, and it also governs the Active Directory engine. The Lsass.exe process is responsible for the following components: • Local Security Authority  See also: Link MICROSOFT
The file is harmless. I got it with my new comp, from a reliable computer store. Perhaps this sasser worm thing just exploits the lsass.exe file in some way. Maniac
The Local Security Authority Subsystem Service - Critical Windows service. It controls the security subsystem. Crashing this process will cause your computer to automatically restart.  See also: Link Daniel Farst
lsass.exe is not a virus. It's the isass.exe that is a dangerous virus that cause your computer to shut down in ca 60 seconds. SO STOP SAYING IT'S A VIRUS NOT A VIRUS
I learned that lsass.exe might be harmful from McAfee Alan
lsass.exe (Lsass.exe) tried to open a server connection to Mexico (traced IP with NeoTrace) shown from my ZoneAlarm program, why would this Harmless Program be trying to open a server connection to IP# concerned
be carefull. obviously if its up your computer and crashes unexpectably, its gonna be a virus. however... i have isass.exe on my comp and have had no problems with it, untill i tried to get rid of it. seems legit kev
This is a part of windows server 2003. sometimes it causes problem with etrust antivirus. Tekchand
If you have less than 128mbRAM then you will have trouble updating your computer. Put more memory in your computer and try again. Ben
Lsass.exe a vital part of windows. NOT A VIRUS - If the last thing you did was a spyware removal eg ran spywarestormer then boot from windows cd and choose repair a windows installation this will actually work - if however if you do have the sasser virus then obtain stinger from mcaffee or the symantec equiv and run this tool through safe mode by pressing F8 at startup - the virus is detected and removed reboot normally and installed antivirus and firewall then update them - If you have played in the registry or have a damaged hard drive then delete partition and start from scratch  See also: Link Rick
Its a windows security file. It does not cause all the reboots but it does get crashed by the sasser virus which causes the 60s till shutdown thingy bad bob
lsass.exe is not a virus. It's Microsoft's one of its gifts that came with Windows. If your computer reboots stating "lsass.exe", then you're bad luck because you got a virus in your system. :-(
This is not a harmful file, just manages the authentication of various users on the system Yazdi
seem to be a regular system process  See also: Link John Andersson
Open up task manager and try to end it. If it doesn't end, its not a virus. If it does, it's a virus. Virus
go to run-cmd- and type (shutdown -a) or install service pack 2 styleeplus
LSASS is an authenticater...most people are thinking of Isass.exe That is the Sass virus file. Look more carefully next time! Unix is my love
lsass.exe can be infected by sasser worm.symantec has already released a removal tool. Also install Ms security patch. Links are given ..  See also: Link Link Iftekar Ahmed
This file is part of Windows, not even slightly dangerous. Mick
like nearly all windows pocesses: if it is in the wrong folder it's a virus Mynx
Typical broken microsoft crap with backdoors left in for whatever reasons. Opterational example at posted URL.  See also: Link Know Your OS
this is a normal process in machines, if that window appears it is a sasser's carchteristic. a way u can get rid of shutdown is by going start\run\shutdown -a Joey
The Local Security Server of XP, if its not infected its ok, if it is infected then it is not the reason fo your problems but rather the result of them... papa
Even giving new task run it wont support only safemode runs and other modes work with it, only few conditions by killing unwanted programs running in process success, final step only by reformating vamsee
People confuse this file with isass.exe which is malicious. Uppercase i (I) looks like lower cas L (l). Chris
lsass.exe has been updated and version changed to match the restore mechanism daniel
its just a windows file but funny because it shuts down the computer if its turned off. davos1
Both exist with the same name, a WIN OS file and a trojan. I m currently infected. It disables run, regesdit, taskmanager and folder options. Does automatic system restart and deletes files important for installing anti virus softwares. its lethal and high stealth. shakti
lsass.exe is the service responsible for authentication (verification) for user(s) logon to the workstations or servers. There is a worm named (Sasser) as defined by Symantec that accquires the same name also in the task list and causes system shutdown within 60 seconds; to stop this action type from the 'Start -- Run..' shutdown -a. It is important to keep ur windows and antivirus updated always. Sherif Khaled
it's as mentioned a part of windows but it's dangerous when attacked, no need to worry about it; as it's a security proccess and all proccesses are virus vulnerable JAcKaSs
the LSASS.exe Security Task Manager flagged for me, was located a few subfolders down, in the C;\Windows\System32\ folder. I quarantined simply because it was not where it should have been and everything's fine now. As it says above, it should be in your system32 folder. If it's not, then it's not the real Lsass, and is most likely the Sasser Worm. borracho
Its at least a MS logon authenticator if in the System 32 dir. The Traveler
Part of Windows security and local policies. Basically you need it to log on. If it fails, Windows will restart to correct the problem. If this is happening to you, repare/reinstall Windows. djbon2112
It is neither a virus nor is it harmful. That doesn't say that someone either has or hasn't figured out how to misuse, or potentially abuse it. Most criminal hackers will do anything to harm or damage a users computer. Jaffar
A vital part of Windows - but- because it is a security component, it is attacked by malware. The Sasser worm, for example, partially works by attacking a vulnerability in lsass.exe. Other malware may replace it with their own software. Other malware may name something Isass.exe (capital "eye" instead of lower-case "ell") to conceal itself from the less observant.  See also: Link Bren Flibig
Its a windows log on process thats for sure, but it may be a trojan too as my computer no longer loads up windows. Error 'failed to initiciate (0xc0000005)' Paul
windows process Maxim
windows process - in win 2000 with connection to internet can't restart the comp Maxim
Windows Security File. Good idea but a Bas**rd when it goes wrong Tim Ibbotson
this is not a dangerous file all you need to do is patch your computer go to www.microsoft.com , and search for the file once patch your computer will not restart when you connect i have had this problem but is now gone... also if you would really want a real clean up (advance users only) restart your computer press F10 at least 10 times till a screen pops up , then click advance , next , then start it will then perform a system disk clean up deleting every thing on your computer except the files when you first ever got your computer , (may need disk)  See also: Link Philip T
It's just a windows xp OS function
my avast! network shield detected and logged a lsass attack. "06.06.2007 16:40:41 LSASS Exploit (SXP) attack, from" justin
LSASS.exe is not a virus, its the "Local Security Authority Subsystem ".But when its written with an i or "I" then its a virus like a sasser or anything else. try to delete it classhero
as a IT-manager i can safely says thats its being used by your RPC (remote procedure call) i strongly advise you not to disable/delete it because you need to keep windows ME to XP stable and running and its being used by some network-services some USB-modems need them to even get connected to the internet, and yes it can be exploited by worms/trojans just install a firewall like zonelabs or sygate personal firewall and all will be well. to be short: don't delete/terminate/alter the file leave it as it is
it is a virus which diable the option of taskbar, it will not let u open the msdos and the folder option get vanished from tools so that neither u can see this nor can delete it Amit Dey
I canceled it and it shut my computer down with the one minute warning
It is safe to block with a firewall, But do not delete it. but blocking it may prevent you from communicating with local computers. PaulZ
This is the error i am getting on my computer right before it gets to the logon screen in XP Pro. When I click ok to the error message it just reboots the computer back to the same error message. Also does the same thing when i try to boot in safe mode. harish.dmvs
If it is Lsass.exe (lsass.exe) then it is not dangerous. If it is isass.exe (Isass) then it is a dangerous virus.
i found this on my computer but it was modified by virus (displayed the flash player icon) 2hot4u
lsass.exe not dangerous if you don't turn on your windows updates.If you have problem with timeout and restart,its mean you have to format your hardisk and reinstall.  See also: Link UpdateNeverBetter
Destroy the packets thats out from the station, it seems that there is a connection (the green screen), even among the intranet. harmful in HP servers (& ISA software),Software dameges especially network softwares. Odwan
If you Do have the Sasser Virus which can relicate the same file name - Lsass.exe or even a lookalike lsass.exe - Start your computer in safe mode and run a Virus scan, if you do not have anti virus installed, run your machine in Safe mode with Networking and download a free version. Sam Reynolds
i receved lsa send dont send error in start up and my lasss.exe yn system32 17 kb nikunj vasoya
It reebots the system everytime it gets to the windows start up screen Kummie
Download AVG free scanner as fast as you can and run it, it it will get Isass.exe out Russ Browne
Er, idk my firewall asked me if i wanted to deny the access to a DNS sever.. so i did.. but im confused.. and i need help.. so idk if i shall allow the access or leave it in denial.. : Chantal
C:\WINNT\SYSTEM\LSASS.EXE infected by W32/Hupigon.MJH virus & seems to be a msp or msi file - virus or not, only my computer knows, driving me nuts! Becky
it has stopped my audio completely.... swades
I have a problem with lsass.exe.. it's not a Virus that's sure. but I have a big problem with it ... it takes CPU value in a range of 3-99 % up and down in a period of 1 seconds ... that slow my computer down toooo f***ing much! PLEASE help christopher.llewlyn@hotmail.com Chris
It is a windows file, but it CAN be infected... Symantec found a virus in the actual lsass.exe windows file.. Windows will run without it... but not too well. I need to reinstall. Don't recall the name of the virus now. electrowizard
lsass.exe or Isass.exe, look the same, they are not, Lsass is not a virus but isass it is, becareful...  See also: Link ticolandia
C:\WINDOWS\system32\lsass.exe is not a virus, in fact it is a necessary program. However, lsass/ratsou.b are hiding behind it and will sometimes appear as C:\WINDOWS\Fonts\lsass.exe, as it did on my PC. It will really muck things up. I'm not rating it because, though the virus is horrible, the intended MS application is needed. K
it asked to have connection with a port on the internet - i blocked it with sygate firewall. Adrian
it constantly uses my computers memory. my task bar is always ranges from 90%-100%. thus making my computer slow. it always slows down my computer. Alvy
Lsass.exe is a windows process, the problem is that lsass.exe uses the L lower case, Isass.exe uses the i uppercase. They look identical. Lsass.exe is ok but isass.exe is bad. sslawter
is in charge of the userame and passwor authentication, however theresa variat of the virtumonde worm that anchors itself to this process and it is very dificult to remove, and may damage the paswors of all users including the administrator account Victor A Godinez
Lsass.exe is not a worm, but a system-file. The Sasser-worm is the dangerous thing! It makes Lsass crash. So, the Sasser-worm attacks Lsass, and the computer crashes. Adrian
This is a necessary component of Windows, not to be confused with isass.exe. Henry
Part of the windows security Richard
juz a normal file that protect agains security reason  See also: Link jonathanycs
i contacted my av ,they told me that this lsass should only be in system32 and not in a folder,if its anywhere else ,it could be a virus,as the hackers copy file names to attack your computer,as long as its in the correct place its ok annette
Uses up a LOT of your CPU. Always a critical process. I only had it one day. never before with my 2 years of owning this PC has it appeared. Conor
A remote computer repeatedly communicate with it at port 500, IP, or randw1.nsw.optusnet.com.au. user from Hungary
it holds busy 99% my Dell Power Edge 2850 server on which window 2003 server ENT is installed and domain controller.if any on have any remidy for it, email me at murad_77@hotmail.com Murad Ali
lsass.exe isnt virus but lsasss.exe is virus NOOBS not a virus
Microsoft Local Security Authority Service: Windows critical process for user authorization and loging Elias
why does lsass take up 50% of my CPU? It is very annoying because I run many things like Photoshop CS3, WMP, Firefox, and others at the same time often and I do need the other half of my CPU Rafterman
Originally provided by Windows operating system, but some viruses disguise themselve as lsass.exe exuctable. Technik
it's a local authentication server file required for user logon but it can also be a virus. in my case it deactivated the task manager, run command on start menu, search on start menu among other few things. i tried to remove it but to no avail. can anyone suggest? Vishal
Do not confuse with isass.exe, Task Manager uses a font which shows upper case i identical to lower case L amwil
NOD32 thinks its a VIRUS.  See also: Link
keeps files open on mountable drives so that you can't unmount them...typcially stupid programming from m$ paver
booted up in safe mode and tryed to end task but denied, tried to remove it manually but denied Terry ist
After boot-up and some web-browsing the Windows Task Manager shows more than 50% of the I/O writes belong to this process.  See also: Link GeoFan49
If you have 2 of these process try ending process the real one will disallow it to be ended the fake one will be able to be ended like other processes Jamesernator
in XP the file is used for security access. if it is corrupt, not running right, or even removed from the system32 directoy, you could get the "black screen of death" with only the arrow which will move around for a little bit. if lsass.exe is ANYWHERE ELSE then it may be a trojan. LEAVE THE FILE IN SYSTEM32 DIRECTORY!  See also: Link Frustrated
It can be a sasser worm virus, but even the real lsass.exe can hog up the CPU and make the computer run slow. I'm still looking for information about what to do about lsass.exe when it is not a virus. Pablo
lsass.exe in the windows/system32 folder is NOT dangerous: it is the Window OS logon authentication process. lsass.exe residing elsewhere in the system (not in the system32) folder ARE dangerous trojans.. Chad
Today I face problem with C:\WINDOWS\system32\lsass.exe missing and I am not sure how do I slove this problem, because I am not able to enter in to windows. Everytime I boot the laptop in the middle itself I am getting this warning. Can somebody help me plz.... Kumar
Visible in the Task Manager as lsass.exe is ok and Windows requires it to run properly. Visible as lsasss.exe, you won't waste too many time observing how dangerous it is. Leave lsass.exe, destroy lsasss.exe at once! Sigurd
This file is crucial for a VPN connection to function. The traffic to your VPN goes through this application. It is a windows system file(lsass.exe). huldu
there is some thing new LSASS.EXE . It is all uper case and I tried everything and it's not going away NADIR
has stopped my log in screen from even appearing. also unable to carry out any functions atall on my computer. any idea's? email me at 'paul_fae_the_ganja@yahoo.co.uk' Paul
Microsoft Local Security Authority Service: Windows critical process for user authorization and loging Tillionaire
lsass.exe stops functioning download files from download software like Orbitdownloader etc  See also: Link sachin s
its a windows system file, the problem is when it crashes windows shuts down to prevent problems lainlives
every time i boot my pc i get this error if i click ok it reboots i dont have acesess to anything girtha1134
It is used in windows startup.... Not at all harmful... Vipul
lsass is a windows file. I'm with you on that but My problem occurred without warning just a reoccurring shut down without any type od OS load. meaning I can't run anything scan or otherwise. I'd be fine if i could get to a c prompt ..but i can't get that far. Also I have updates to sp3 any ideas? :)
part of windows. lsass.exe
it's not harmful naruto
There's alot of info re lsass.exe on microsoft.com.
make sure of what you are looking at... "Isass.exe" or is it "lsass.exe" or is it " sass.exe" choose wisley grasshopper. David
when associated with the sys32\lsass.exe is importatn for logon authentication Schmiegels
Two of Our PCs at our company have been shut down with an error message includes( isass.exe) we, as IT People could not access the windows again as the computers were hanged... at the end we formated them.. Hamad
Critical for windows functioning. I force ended it just to see what it did, and my com immediately started a shutdown countdown.  See also: Link Tw15t3r
This file is a part of Windows(R). Nothing to worry about, but some files like this one in different locations may be a virus. COHA Systems, Inc.
it may be a trojan named SASSER
it ther in AppPatch file c:/WINDOWS/AppPatch , wat i do know. pop up always thru AVG. distrub my work. that's all abt it. sara
lsass is a legitimate Windows object for user authentication but it is vulnerable to the sasser virus and can be HiJacked. Someone please clean up this place as at least half of the entries are worthless. Let's try and be useful here and not cloud the issues. SomeOneWhoGivesaShit
it's the NT LM Security Support provider. You can disable the service and you should still be fine. Been running w/out it for a few years. No malware. People get malware b/c they don't use good AV and FW. uncoolcentral
Hallo? des is von Microsoft; alles von denen is gefährlich!! Apple User
Have the error message for Bad Image C:\WINDOWS\system32\SAMLIB.dll - reloaded entire PC and when I connected bad to the network got the message again... reloading machine again and stil not sure how to get rid of error.. Saheyala
lsass.exe is harmless and if u kill it, it's likely to reboot or revert to welcome screen. two famous viruses are lsass.exe begining with an "I" or ending in triple "s" no one
While the "real" file is a critical part of Win security, this file is a frequent target of trojan/virus activity. Don't kill this out-of-hand, unless you really know what you're doing. A good anti-virus/anti-spyware should keep you safe. SatyrMage
this is a system file.. and one of the essentials for the OS, but the problem is that... most exes can be replaced an exe with same name. If u suspect the exe is infected ... send it to www.virustotal.com and wait for the result. Cheers. ;) cute_snifer
I need to stop the process so the internet browser can load a page. Halogen
Seems to be dangerous. Kill it in task manager, then execute msconfig and remove it from startup. It seems that there is also a lsass.exe process that is from Microsoft, but you can see which one is from Microsoft and which one is not by the username listed in the process list (the dangerous one is running under your user username, the Microsoft one is running under SYSTEM) Domagoj
when i boot my computer is has the "lsass.exe - application error" the message says the application failed to initialize properly (0xc0000005) click on OK to terminate the application. and it doesnt exit until you press "OK" and it repeats the message once afterwards then dissapears and its left on the current screen
Systems operation...all normal. Apple sux
I found it in my Application Data folder, and Nod 32 cleaned it up. Bob
I have win7 64bit, and this file was 32bit, so it is a virus, because it is not a system file(would be 64bit too). The virus collects passwords. ugaJ
It is A Virus SomeTimes ------
lssas.exe -insufficient system resources to complete the API
i found lsass.exe message in our server,that mention traffic block , recently printer and some users showing as offline , is it problem of lsass.exe kabeer
Isass.exe is a trojan, its cleverly named to look like lsass.exe but what seems to be a lower case L is actually an upper case I if you change your system font you will notice the diffrence xxthugxx
"lsass.exe" is a legitimate WIndows process IF and ONLY IF it is running from the System32 directory. If you notice this running from another locations (I had it in the AppData/Roaming folder), open up task manager, kill the lsass.exe process and delete the file immediately  See also: Link Tony
consider where you/your av program finds it. if in system32 that's one thing. if in some user subfolder, delete delete delete. the one dave
has been affecting web searching(redirects to random website) reboots computer irritated with norton support
lsass.exe is a dangerous file. My AVG found it as a Sasser.Win32 or maybe it was a false positive. Kalka
It doesnt show my desktop when it boots, i use windows 7. And i typed explorer.exe to get my crap back on like desktop
it`s really dangerous (especially for slow and old PC`s) because it consumes a LOT of PC`s resources...also because of thoose restarts ... Kefyras
If its not in the system32 folder then its dodgy!! i found it in the users location and anytime i attached a lan cable the system would restart, eventually removed it using HiJackthis and then updated my antivirus thru wireless and fixed it. TeHWaBB1t
LSASS Stands For:Local Security Authority Subsystem Service. When You Terimate Lsass.exe All Its Users on The Logon Screen Will Be Gone And Then...Restarts The Computer Madisyn Williams
Look out also for lsasss.exe (an extra 's' but not easy to spot) - I think that one *is* a virus Bob
Its blocking my connection to internet. I'm using windows xp service pack 3. I used to connect internet using reliance netconnect. But now its not possible because of this Isass.exe file. How to remove it from my computer? Sachin
Isass.exe with a capital I is harmless, but if the spelling deviates for example with a small 'i' issas.exe then it is a virus. Minimal deviation in the spelling of the original process is a sign of malware on your computer trying to fool you in appearing harmless.  See also: Link Lucky
If lsass.exe is not present in your \system32\ then it is indeed a virus. The legit lsass.exe lies within your system32 folder. It seems to like the AppData\Roaming folder. I just got this virus and removed it.  See also: Link Akari Shinrai
lsass.exe is a native executable for Windows. However, can be remove by some malicious program(Nothing is impossible in .bat). It reminds about CIADOOR.122 which is aliased as lsassa.exe... Noob Bobo
it is not useful....it just uses ram for nothing making it slower :( Hablumiua
my avg has 6 trojans on this file Anonymous
According to Norton Antivirus 360, this one is the paid version, if the lsass.exe file is a risk, it will automatically detect the threat. Just be aware; If your computer starts restarting and causing unwanted messages, it would be better to get another antivirus scanner if your original one cannot detect it. lsass.exe severity was at a HIGH level. Velocity
Isass.exe is a program for windows, But it's one of the top things that hakers like cus, it's so hard to pic up on the harddrive, and it has a format to kill everything, it can get enywhere without problems from the firewall, windows thinks it's a pertection software. If you have this running at start do a Virus scan. It takes 63 secs to shut down your computer. If you find it in the 32 system folder delete it. Not many anitviuses can find it. Again if you find it delete it
Crashed my system
If in C:\win = worm RapimmelKakazu
it's a part of windows. though the sasser worm can make this and the hole computer to crash ...
It is not a virus, it is used for system log on. User123
it can be a local security authority programm  See also: Link The Virus Breaker Man
i think it is created for security reasons; like as defined , it generates a token for user's access to the sytem. Arucard
The correct one is 13312 bytes and 04/14/2008 22:00:42 Hardy
it comes up everytime i boot up to desktop ter
Can be Dangerous, once infected by worm IknowNothing
A harmless file in itself but block other computers on the internet wanting to connect to it
The process lsass.exe is the Local Security Authentication Server. It is a safe file from Microsoft and is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.  See also: Link Anita
Not really affecting the comp I'm on much at present. Haven't received any shutdown warnings, but keeps on causing Trend Micro to block it and mark it as a high security risk. Based on what I've read here, there's a lot of debate about what it actually is. System scan shows it as clean, but the date on when it was created has me suspicious... Says it was created Feb 14, 2011, and last modified today when I accessed the Net. That's got me confused. Any answers on that point? Draco Weiss
Local Security Authentication Server  See also: Link LOL
lsass.exe and sass.exe are two different things people. Use your Head
ok its dangerous because, my child did not know how to handle it and in 3 dazs if you not repair zour windows crash, but the problem is bigger, zou can not instal any version of windows and i dont know why, thet lsass.exe eroor apearde and i could not open mz windows, so i decided to put another version but nothings work, pls if you have any ideas tell me becauze we can not stay much longer without a pc angy
it just pops up a file that links you to Windows Explorer and when I start up my desktop doesn't load and i have to run explorer.exe manually. and when i search for this online it causes my computer to auto restart. goddamn deadly trojan :( NikoBellic055
Lucky: It's not ISASS, it's LSASS. nyuszika7h
safe but depends on how ppl use it!  See also: Link Shan
Legitimate part of the Windows OS. LSASS stands for Local Security Authority Subsystem Service, and it (apparently) controls login info. It should be in C:\Windows\System32; if not, you need to go into Task Manager, end it, and delete, it's a virus. If you go into Task Manager and find lsass running under your username, find it in Explorer. If it's in System32, then run a virus scanner over it. If not in System32, end the process, thendeleteE. If the filename is ISASS instead of LSASS, end anddelete. Same goes with LSASSA. Austin
I have one Isass.exe in folder C:\Windows\system32 (Description: LSA shell Export Version; Microsoft Corporation; Version: 5.1.2600.5512; Date created: 8/4/2004 6AM; Size: 13.0 KB) and another in C:\Windows\ServicePackFiles\i386 (Description: LSA shell Export Version; Microsoft Corporation; Version: 5.1.2600.5512; Date created: 4/13/2008 6AM; Size: 13.0 KB). The operating system is a Windows XP Professional PC version 2002 Service Pack 3. Gohemi
Depends on original file location, must be in system32 file, use task manager to find location  See also: Link Abstract Meta4
Integral part of Windows OS; validates logins, if corrupted is by users' negligence. Palindrome
you really have to make sure it's not a fake by running an anti-virus scan on it. If it gets labeled a worm/virus then remove it. If your anti-virus says its fine, update the anti-virus and run it again. it's always good to be cautious, just don't overdo caution Neutral/Cautious guy
The worm Sasser uses an exploit in lsass. Just be careful. Techwiz
This is a Trojan steven
Its causing my computer to Reboot again and again!!! Jibran Haidery
it slows down the pc
its safe and dont wory matin
Open the task manager and click the "Processes" Tab Find the Lsass.exe under Image name If the user is SYSTEM then its fine If it says Lsass.exe and the user name is your name You have the virus. This virus spread throughout DOD computers worldwide. It is launched from an EXE autorun.cfg on external drives or thumb drives when you plug it into your computer and Auto run activates. Open up the external drive with hidden folders shown and delete the autorun.exe files on the drives. As for the computer, Create another admin account (control panel users add new user) reboot Log into the machine using the new profile with show hidden on, go into your main profile (c:\documents and settings :: or vista/7 C:\users) Locate the Lsass.exe file with shown hidden files on. The Lsass.exe is saved in the main folder of the user's profile (c:\documents and settings\username) use a shift+del for this file. Reboot the machine. The Lsass virus is gone... Just make sure you clean out your External drives... This virus spreads like STDS... Be mindful of what you stick in your computer’s USB holes... It has feelings too!! :) Jtate
Mine is noted as "(unverified) Microsoft" [by "Process Explorer"]. Listed path is Windows\System32\lsass.exe 'Killed' it; (experimentaly); shutdown my computer. John Miller
essential system process!!!! do not terminate the process or else you get a Blue Screen User32
This is reqiured for Windows XP. pawexjon
My Norton system reports this file is using a lot of resources but finds no suspicious activity. Roy
My firewall keeps warning that it wants access to the internet I have checked to keep it off permanently. I do not know what it will do. Bill R
LSASS.EXE is now consuming over 1,270,000KB of memory! That's 1.27GB, and it's been rising the whole time I've been monitoring it this evening. RAM use for lsass.exe now stands at ,295,000KB. see if you need any help http://forums.techarena.in/operating-systems/1449911.htm#post5548238  See also: Link wintecher
im running xp sp2. my problem is that lsass.exe is failing to initialize. since it wont initialize all i get is a black screen and an error window stating that it wont initialize. would it be alright to just replace it with one from another computers with xp sp2? please email me at trainwreck995@yahoo.com kronos
As far as I know, with windows7, is that the lsass.exe file is also located in C:\Windows\winsxs....\ as well. The original post (top) says ONLY system32 wantowan2
Ok, just stop your commenting and listen to me! This is rated don't know because there are multiple types of this file. 2, to be precise. Before you think it is a virus, look for the symptoms. These are the symptoms: Adds the value: "avserve.exe"="%Windir%\avserve.exe" to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Use regedit to check this Creates a file at C:\win.log that contains the IP address of the computer that the worm most recently attempted to infect, as well as the number of infected computers. If none of these symptoms are on your computer, then it is not a virus. If so, you have the W32/Sasser.worm virus. If these affect your computer, you are almost screwed, and I don't know how to remove it, however I can tell you some handy advice. 1. The shutdown sequence can be aborted by pressing start and using the Run command to enter shutdown -a. This aborts the system shutdown so the user may continue what he or she was doing. 2. A second option to stop the worm from shutting down a computer is to change the time and/or date on its clock to earlier; the shutdown time will move as far into the future as the clock was set back. The answer to your problems
lsass.exe id fine but Lsass.exe is nto safe  See also: Link imyurhere
This is a key part of a working windows system. The user opinions shown here illustrate clearly how following crowd sourced opinion can destroy your computer or worse! LetsBeSensible
This file is not seen by me usually in my computer, but these days I am seeing it and it is using 100 % of CPU and system is very slow, I tried to end process it but I coudn't. Atif Malik
Got hit for the second time by the Moneybucks scam virus. First time round it was contained in an exe called guy12.exe but this time it seems to be hidden in DLL files, executing as applications and named after standard Windows files (lsass, ctfmon and wlsidten). The files are showing up in the wrong folders (in TMP folders), and referring to each other despite clearly different functionalities. GCS
Got virus that disabled TaskMgr (screen flashes then goes away) disabled System Restore, and disabled VirusProtection To fix: I ran procexp.exe (sysInternals tool), and saw 2 lsass.exe running (should only be one). Killed the bad one that was running from AllUsers folder, and then TaskMgr problem went away. After moving bad lsass.exe to another folder, when I rebooted, problem still there (running the bad lsass.exe from the folder where I copied it to). So I replace the lsass.exe in bad folder with the GOOD s\system32\lsass.exe version, ... Now investigating the AutoRun tool from SysInternals, which is causing explorer to start the lsass.exe at start up. I have re-enabled System Restore, but because of the disable, all previous checkpoints were removed (A bad design feature in my opinion). Joe Cole
This file can be very dangerous and can do DOS attacks and disable LAN if is not in Windows/System32 Folder Morteza Niknam
part of windows op lol
lsass by SYSTEM is not a virus George
It is only a virus IF something infects you're computer. So, if you have never received a shutdown message you're safe, if you have, you're computer has a 75% chance of it being a virus. Chris
It is used for NT authentication
lsass is a part of Microsoft Security is called by two services. These services are default configured to: adjust action recovery not allowed (via management mmc), service failure: restart pc. Service Name: SamSs (Security Accounts Manager) user data Service Name: Protected Storage (Protected Storage). private data ... whatever. Microsoft definition gives false impression, he is a smartass if security is not available, find another solution than this shit! Axel
It is not a virus Hendrik
I am doing a defrag of C: using the windows disk defragmenter. When I look at Task Manager, lsass.exe is churning out I/O byte writes like crazy, so this lsass must have something to do with file system management also. Bobbyrae
This file is vital to the Windows operating system. To what I know, it operates within Windows 7 and is a module to assist in the Winlogon process. It's safe as long as it's from the "(drive letter):\(your windows directory)\System32" directory. Lildirt
Safe, but...uses more resources than my anti virus while scanning. Thats real High, for a process that controls user log ons.Why is this so high especially if I'm logged on Tony
The actual Windows process (System) is important. One that isn't in System is probably a virus.
 See also: Link heqta
lsass is completely safe unless operating from outside system32. In order to prevent malware from attacking/abusing it, make sure to keep windows updated. Deeza
its a system file use for authuntication Zee
Safe system file if in the [Bootdrive]\[windows directory]\system32 folder. Note even the legitimate version of this file can result in a forced shutdown IF it crashes. John
Hogs CPU time immediately after booting! Girish
What is lsass.exe? Lsass.exe is a process used by Microsoft's Local Security Authority Subsystem Service.  See also: Link CedFalz
Because lsass.exe is a crucial system file, its name is often faked by malware. The lsass.exe file used by Windows is located in the folder C:\Windows\System32. If it is running from any other location, that lsass.exe is most likely a virus, spyware, trojan or worm.  See also: Link Uros
The file is an official microsoft operating system file but if it is compromised/replaced it could very well be a virus. If in doubt, best to check the file contents against the original file in your initial windows system backup or another installation of the same windows version on similar PC platform. WeDidntStartTheFire
Use a lot of my cpu in google Shadow
Forced GPU usage to 100%. It's a big danger for GPU. CIA
This is an essential file for security authentication. If you run Discovery or other types of network identification software it is necessary. The fact that the process is attacked by some worm is irrelevant to file itself. Matt
This is the Sass worm
Its part of the Windows Operating system, often mistaken for the sass.exe file (the one you would not like to have on your system)  See also: Link Harrie
Avast found multiple instances of this file located outside where it should be. My PC was shutting down randomly, but since removal is now okay. Jordan
I havent had any issues with it, and i've had this system for 10 months now Manikyn
The (win32) file asks a lot to have access to system resources/registry....I'd keep my eye on this one if your system seems to be acting strange. MPD

If you know more about lsass.exe, share your knowledge and help other users.

Security Rating:
Your opinion about this file:
Web page with more details:
Your first name:

More process information

Is lsass.exe spyware or a virus, trojans, adware or worm? Is there a known lsass.exe error?

Other Processes

[lsass.exe in German] [all processes]