| All comments about lsass.exe: |
 Altair | it works depends and shut down the system at random |
 Martin | Microsoft Local Security Authority Service: Windows critical process for user authorization and loging |
| anthony | windows crashes by the sasser worm. When it is infected it doesn't run neither regedit. |
| Anthony | symantec associated the "sasser worm" with this |
| Stephan | Falls Windows wieder automatisch runterfährt, hat man den Sasser Virus. Man kann das unterbrechen indem man: Start - Ausführen und dann "shutdown -a" eingibt. Ein Remove-Tool gibt es auch. See also: Link |
 Lisa | Part of the Windows OP system |
| LordScav | As before has been mentioned, a completely innocent system process and a dangerous virus come with the same name. No need for panic but keep your eyes open. Virus removal information can help determining whether you're dealing wtih fake lsass.exe or not. |
| Mark | PC shuts down the system with code 1073741819 See also: Link |
| Joe | It is required for Win2000 & XP to work. Viruses (Sasser) attack it! |
 thanks | If you have the Sasser worm: abort shutdown by going to run and enter cmd, then type shutdown -a, make sure you update windows entirely See also: Link |
| Robert | Computer reboots at random, patch helped immediately |
| Antonio Bell | When I'm connected to the net. it times me out and reboot my computer |
| | Prozess beenden fährt PC herunter. Der lokale Sicherheitsdienst lsass.exe steuert die Richtlinien für User. Wenn Sie nicht als Administrator angemeldet sind, und nur auf bestimmte Dateien zugriff haben, ist die lsass.exe dafür verantwortlich. Versuchen Sie sich mit einem falschen Usernamen anzumelden, wird die lsass.exe dieses feststellen und den Zugriff auf das Betriebssystem verhindern. |
| Githoniel | This file has been causing problems lately... it keeps on "terminating unexpectedly", so the whole computer has a system shutdown in one mintute |
| Mehmet Ali ALTAN | There was a virus in my pc with the same name. Whenever I enter to the net it infecting in 20 seconds. I cleaned it very difficult by updating windows security and using special cleaners for this virus. |
| frank | im windows eingabefeld "shutdown -a" eingeben....dadurch wird der pc nicht heruntergefahren...ist aber nur eine vorübergehende lösung da der virus...noch nicht entfernt ist |
| Sawyer | Lsass.exe is not a virus |
| JoSe AnDrEs | its either the sasser worm or its not the problem |
| Marshall | McAfee says nothing about this virus creating any file named lsass.exe. It does say that the virus causes the computer to reboot by crashing the lsass.exe process. Subsequent error messages mention this legitimate process as having failed. There is NO need to remove lsass.exe it is a vital system file in a networked computer. See also: Link |
| Kalhau | has a key in registry wich allows ir to reload each time you conect to the net. use a virus removal tool in safe mode and you may get lucky See also: Link |
| Farid | I was infected by Sasser. This file is not reliable. |
| Matt | sabotages Messenger restart in 60seconds error |
| Cruel Device | Error messages containing lsass.exe indicate Sasser-worm. lsass.exe is NOT part of the worm, it's save. |
| Troy | As has been said, the worm exploits a bug in lsass.exe that causes it to crash. Lsass.exe is NOT the worm itself. If it were a worm, it certainly wouldn't be advertising itself by displaying a message with its own name in it. |
| Samantha | This is not a virus, the Sasser worm attacks the lsass process and that is why your computer may shutdown, since the worm stops the lsass process from working |
| gunni | Lsass.exe (lsass) and Isass.exe (isass) is not the same but looks like same...lsass is good, isass is the bad one |
| Bob | I was infected by this 30 minuteas after going on the net |
| DataFighter | Der lokale Sicherheitsdienst lsass.exe (Local Security Authority Subsystem) steuert die Richtlinien für User. Aus gegebenen Anlass: Es gibt einige hilfreiche Links zum Sasser Virus, welcher sich der lsass.exe bedient. |
| Martyn | The Windows File itself isn't dangerous, what everyone here is describing is a virus that fakes the windows filename - so lets not get paranoid about every lsass.exe we see... |
| Helvetica | Just use Windows Explorer to check the date of the file against other files in c:\windows\System32. If you find lots of files with the same date it usually means it's a required Windows file. Another way to check files is to do a right-click on their name then select Properties and look at the various info listed there. |
| hackman | i have done research on this program and i think people are getting confused with sasser virus this lsass is a system program if you remove it your computer is left wide open for an attacker as lsass.exe is a security program to verify computers on your network so dont panic! |
| id1250 | In the Windows/system32 folder it is a necessary file. Anywhere else and it's a virus! Caution, Blueyonder will tell you to search for sasser files and if you find lsass.exe to delete it - don't if it's the legit one! |
| Jon Sasser victim | lsass.exe is part of the operating system with file extention .exe.hdmp or .exe.mdmp its part of the sasser worm virus. It looks like its gone when it has not. don't know how to remove it totaly as virus software dosen't. |
| Die Salomon | A default startup process which controls log on security. The following link provides a list of default startup processes for W2K.. See also: Link |
| Myr | If it is a System proces it isn't dangerous, But if the process is in your name it's a virus |
| icha | gue pusing ngadepin masalah ini, karena kasusnya masih jarang. dan terjadi pada saat koneksi ke internet |
| VirusKiller | Isass.exe and lsass.exe is allmost the same, they can be mixed up and are hard do repair |
| Smash | harmless security file that can crash and cause shutdown, if this happens go into c:\windows\System32 and run lsass.exe to bring it back to life :) |
| Die, Die Salomon | lsass.exe doesn't control security, it's merely used by winlogon to authenticate users. Winlogon will then react on whether the user is properly authed or not. |
| | PC shuts down the system with code 1073741819 |
| John | causes the computer to reboot! |
| Addy | It causes your machine to reboot over and over |
 BrianG | Authentication service located in various places, but should only run out of c:\winnt\system32. Other seemingly safe locations are C:\winnt$NtServicePackUninstall$, c:\winnt\$NtUninstall*, c:\winnt\ServicePackFiles\i386, or c:\winnt\system32\dllcache. |
| Doug | Windows critical updates include this file. It is imperitive that you have the latest updates to be protected from viruses/worms/trojans |
| Dj Project Ho | It's just the same name as the Sasser virus, but it is a f*cking Windows Process See also: Link |
 DaV_serveR | This is due to the sasser virus (and variations) attacking the whole system 32. It will cause your computer to shutdown in approximately 62.5 seconds. In the code: the time to shut down - 62.5s is found. Whenever you access the internet certain sites (with http) activate it; then you have the allocated time to shutdown. Other variations include shutdown times of 30s and 124s. The worm is rapidly transmitted over a LAN and replicates instantly. However, the good news is: it is nothing that antivirus doesn't handle. |
| Dennis | Nicht viel, nur sie von einem Deutschem (?) programmiert wurde. Hoffentlich ist er im Bau, wenn nicht sollte er mir besser nich übern weg laufen. |
| Mike B. | I have this on my computer and it's working fine. No problems with restarting or otherwise... |
| palani.s | because not securty all files See also: Link |
| ramesh_2k12000@yahoo.com | its reboot the ststems with in 1 min |
| santiago | it will reboot my pc unexpectedly and randomly,without any special reason |
| xxx | Very annoying... Always reboots my computer before the system updates have a change to download! It's a totally new comp too, so I don't see how it could be a virus. |
| help | Sasser attacks this Windows process. lsass.exe is not a virus itself, it is shutdown by the worm. |
| | I don`t know nothing , but I need help getting rid of it |
| Kachiko | Sasser abuses it. Update Windows often to prevent problems. |
| Naseer | When i seeee (YOUR COMPUTER WILL BE SHUTDOWN AFTER 60 SEC) simply go to ms dos and type "shutdown -a"........... See also: Link |
| Jarmo | It causes many unvolentary shutdowns, shame on MS? |
| Solace | Its just a normal OS file. If you have problems with your computer shutting you down saying there was an error with it...Then you should look into the sasser virus. Once you update to the windows xp service packet 2 you will have the lsass.exe file in two if not 3 folders. All three in windows one in the service packet folder one in the system32 folder and one on some computers is in a folder called SoftwareDistribution. If the file is in any or all of these directories it is fine. |
| Poindexter | Real windows file (unless tampered with). Love reading others lack of knowledge here on the subject.. See also: Link |
| viktor vasquez | i know that i had service pack 2 for xp and when i removed it back to the previous service pack 1, it gave me lsass.exe and services.exe is missing and the screen goes blank |
| Lloyd Plueschow | Seems to keep my hard drive busy |
| Aatif Ijaz | This file compels the PC to reboot showing one minute alert message. |
| jami | It reboots your system at any time |
| Travis | i've deleted 6 of the same virus in last few hours called W32.HLLW.Gaobot.gen with filename lsass.exe so somethings up |
| Prashan | This is not a harmful process |
| Anup Deb | it works depends and shut down the system at random |
| Bastiaan | Isass.exe (the virus version) will shut down your computer when you just made a connection to the internet for a couple of seconds/minutes. After that, it will give you a warning window, that the computer will shut down after __ seconds See also: Link |
| | there are 2 proceses: Lsass and Isass (in lowercase: lsass na isass). If you have the proces starting with i -- that's the worm. If you have proces starting with l -- that's windows file for logon :) |
| A S | Anyone who thinks this is "dangerous" has no idea what they're doing. This is a core security authentication file. Anyone who marked this dangerous is confusing it with "lsas.exe," the Sasser virus. |
| ph | Windows Operating System File, Service Authentication. If not in system32 folder, then it is a virus, otherwise completely harmless, and required to run the operating system. |
| Charlie | Symantec did not see anything weird. But it sure seems like it's taking up alot of processor power. Also svchost seems to be running quite high |
| zack | There is very important that you see in Windows Task Manager\processes is it lsass.exe or lsasss.exe !!! Lsasss.exe is Saser virus! |
| Jana | It reboots your system at any time giving me 1 Min to close the application. I have no idea how to correct this problem |
| Mat. M. (System Developer) | Legitimate XP file, is targeted by viruses, is NOT a worm/spyware. Infection of this file is due to negligance of user. |
| Marc Lesther | It stop others from viewing your file over the LAN |
| Sue | Not a worm - Sasser has different filenames See also: Link |
| euge | looks it locks and shutdown the pc |
| | its normal windows proces... ;-) |
| jim jacobs | threw away my computer See also: Link |
| Babanelos Sakis | It cause shutdown See also: Link |
| Xtra_Zero | Like many other Windows system processes, virii can take the name of this file, however, this file is also an essential file for the Windows OS. The Sasser Worm is the most common problem associated with it. The Sasser Worm attacks the file, and as a safety precaution, Windows shuts down so it can restart a fresh copy of the file. The problem is not normally with the file itself. Updating Windows will fix this problem. |
| LouDaman | It's legit, but could get hijacked if not patched properly and no updated antivirus. Service packet 2 lololol! |
| Al Hession | This file has a lot of flaws which viruses target ie sasser virus. If attacked you will have problems that even windows updates won't clear. Your better off either going into safe mode to run your antivirus then or reformatting |
| Alberto M. Vernieri (Argentina) | The process by itself is not dangerous, but it is easily infected by virus sasser, who has harmful effects. |
| Jason B. (illinois) | Something to do with windows authentication. When LSASS.exe is corrupted by Sasser or one of its variants, it causes Windows to reboot. From what I understand, anything that causes LSASS to operate improperly will cause the NT Authority Service to reboot the computer. You stop the reboot process by typing "shutdown -a" from a command prompt. |
| Meister.Þrøpper«« | Ist nicht gefährlich. Achtung nicht mit Isass.exe (isass) zu verwechseln |
| Ciccero | system file |
| MunkY | It causes system hangs and shut downs. if you are having problems opening regedit, try booting in safe mode and then going to the regedit icon and renaming it to : regedit.scr : This opens the file as a Screen saver and will open regedit. :) |
| sonic | lsass.exe...i'm not sure if it is the cause of my .doc converted to .exe file as i save it in diskettes.... |
| Bob | Lsass.exe have the same name then the file in system32 directory. Open the internet, then an error box from Microsoft appear(send the prob. to Microsoft...) then click dont send. A timer is lauch at this moment and you have 1 minute to find something. 1 solution is to fdisk /mbr because if you try to format c:, the worm still on your hard drive. Not dangerous but very bored! |
| Timmy McTimmunce | The lsass.exe file is needed for logon authentication and is needed especially in a client/server environment. The sasser virus is a completely different thing, if your computer begins a countdown to shutdown when you open a web browser or when you start up messenger, then you are infected by the sasser worm. Get cleaned up by running AVG free from www.grisoft.com |
| SuperMe | LSASS.EXE is necessary for the XP OS. Symantec has a removal tool for all variants of Sasser which I would recommend you run. Before you run the tool, ensure that you have disabled System Restore. Clean the infection (if any) and update your OS by installing or re-installing the latest service pack and critical updates |
| not you | lsass.exe is part of windows OS. If you delete it, or confuse this with a virus, you are retarded and shouldn't be using computers. Check the spelling and it's location people!!!!! |
| Steve M. | Legitimate part of WinXP that sasser worm can exploit. MS site has free check to confirm whether your file is OK or not. See also: Link |
| Rohit | Its an .exe file but doesnot harm . It irritates a lot due to abrupt message for shutdown within 60 secs. |
| admin | if lsass.exe can provide a shutdown im not so sure. but if than try it with shutdown -a .. only on XP, and not other |
| Preacher | Lsass is a normal windows system process, but it is part of a very large security hole in windows. You have to download the patch from microsoft to fix it. You can disable the shutdown by running services,msc from the run option in start menu, selecting Remote procedure call, and selecting the recovery tab, and setting all of the boxes to "restart service". |
| Michael | It makes the computer not able to get to Win (normal & safe mode). Repair or format needed. |
| Amit Ganguly | It causes shutdown, spreads in the network and generates a huge traffic. See also: Link |
| Jens | it reboots ur computer and disables the internet / network |
| Mathias Trolle Nielsen | it works depends and shut down the system at random |
| porque | needs windows operating systems .causes frequent shut downs but hardly any loss of data |
| YK93 | That it keep shutting down the Windows Station... |
| Frank | It also causes my PC to reboot over and over - Windows never starts up |
| Ben | I found both lsass.exe and lsass.dll in my PC. My PC was shut down in 1 mins after I connected to broadband. It displays "lsass.exe terminated unexpectfully with status code 128. System shutting down in ...". Found "W32.Spybot.Worm" and some other Adwares in my PC. The worm also exists in "system32\crss.exe and spoolscv.exe".Symantec gives suggestions to remove the virus |
| Voskuh | "lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. |
| Johan Does | Use KB835732 patch from Microsoft, depending on OS version, find stinger.exe (McAfee) to kill sasser |
| Édgar | A not harmful process , don't missmatch with lsasss.exe releated about sasser. |
| Arun C (Amrita) | It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token. |
| shane | Keeps shutting down computer while on the net. I removed it from windows/system directory and it fixed the problem. |
| Chas | just purchased new computer with Win XP.What is written here explains my problem. Never come across this before in older Windows. Obviously a case of looking into the cures posted. Thanks to those of you who bothered. |
| dave | I found it after I disabled xp`s firwall and alg.exe dissapeared |
| Gordon | seems to be both a system process and a virus |
| irwinhkp | This file appears to shut down your computer as soon as you try to run the windows update. Is there another way of running the update without going online |
| Kaffee-Klaus | Diese lsass.exe fuhr mein System runter solange ich mich über comundo ins Netz wählte. Seit ich auf T-Online umgestiegen bin, keine Probleme mehr trotz selben OS. |
| James | Please help me email to raptor101@swiftdsl.com.au as lsass is in my C:\windows\fonts\lsass.exe and when removed sucks my system |
| Andriyana Tresnawan | It kills the internet access and lan security |
| Mike | the file takes care of your passwords etc... |
| Filip | Bringt das System zum Absturz |
| Ibro | The virus forces my system to reboot given 30 seconds within which i'm to save my work, |
| | if it gives shutdawn window, do this... goto start and run and type "shutdawn -a" and u will be happy |
| WHAT?!?!?! | IT'S NOT DANGEROUS!!! system file |
| the pimpChimP | its a windows file |
| | So far know one has given a solution to this problem. |
| Dean | This is NOT harmful. Sheesh people - learn a little about your computer before you post a message saying this is a virus! |
| fernandez@jose-arturo.com | This file name is the title to a window which states "When trying to update a password, this return status indicates that the value provided as the current password is not correct". And about a second afterwards, system reboots without a chance to go into my desktop even to run the shutdown -a command which I've read stops the constant reboot :( So not sure how to get out of this one. And my CD drive is not recognizing any CD, so I can't run a QuickRestore program to put system back to original settings. Any suggestions, I would greatly appreciate it. |
| Reo | Sasser affects this system file, when no infection is not dangerous |
| | seems like the virus was named after the process to make people wory when they explore the running processes ;-) |
| Herbert Matthews | Not a Worm just a leech-This File will hang your PC when booting very annoying |
| Matt | shuts down computer everytime you are connected to the internet doesnt seem to affect my computer thought when i have windows xp firwall on. To activate the windows XP firewall click on control panel, network and internet connections, My network places(in top left hand corner), view my network places(top left hand corner) then right click on my local area connection, click properties, click advanced and click the little box so a tick will appear in it to enable it. Turn off your modem before you start up your computer to give you time without the shutdown box popping up and shutting you down! |
| Paul | An OS file in Windows XP. Used to authorise logons. Local Sever Security Authorisation Service. For those worried about the virus, simply do not connect to the internet without installing a firewall before establishing a connection! Those who threw away their PC's are a bit silly. Fixes for the sasser viruses can be d/loaded from another pc. |
| PPA | lsass.exe ist der Wurm Sasser. Geben sie einfach bei ausführen shutdown -a ein und das Problem ist erstmal gelöst. |
| Boris Frickmann | Hab Isass exe beim win xp start drinne und es sperrt mir das xp ab bzw lässt mich garnicht rein. Hat wer ne ahnung wie ich beim systemstart vorher in die msconfig komme ? See also: Link |
| hahgehweh | mein rechner fährt dauernd runter und die datei kann ich nicht löschen. es bleibt mir nur noch format C: doch das ist viel arbeit. See also: Link |
| DA | Kann den Wurm SASSER enthalten; Removal tools siehe Link See also: Link |
| JHAKKAS | THIS IS A COBRA FOR ANY COMPUTER |
| NOT SASSER VIRUS | lsass.exe is not a virus. It is a working program of WinXP. My school's network manager even had trouble understanding this and the network security kept calling me to tell me I had a virus. Good lord the incompetence is abundant. |
| CherryKissies | Sucks..I can't get into safe mode, My computer starting shutting down..Now It won't even boot up into windows..Keeps saying lsass.exe error found.. I don't know how to fix it..It keeps shutting down all my virus programs I scan with too..HELP |
| Stan Mircea | it is a virus (worm) generated from source code of sasser. i think it is a real danger because i've got it and he produced me some damages...crashed hdd,can`t open my optical drives...that`s all |
| Al Schemmer | firewall caught it trying to talk to s207-81-158-224.bc.hsia.telus.net, I would say it can be misused somehow |
| adil akthar | This file is not a virus. If you have any third party appllications or vb programs which calls the windows api's and if the function fails then their will be lsass.exe error |
| sergiulic | when i am in the LAN after a few seconds on my screen apear that error ho said that my pc is shuting down in 60 sec. i don't have this problem when i am connected to the internet. i have the windows 2000 pro operating system and i don't know haw to get reed of this error |
| omjaiswal | lsass is a vital system file which can be afected by sasser virus and it causes system shutdown in 60 sec. |
| benjamin | Lsass.exe is not a virus |
| Michelle | It shuts down my computer so I changed a setting on my computer and now there is no sign of error now but I am wondering if it will harm my hard drive as it is 1 day old |
| lsasser? | I am updating my xp EVERY DAY and just yesturday I tried to start my laptop and at log on, it gives me a lsass.exe-system error message saying that An invalid parameter was passed to a service or function. I update my computer every day and have all the service packs installed. |
| Kematian | lsass = local security authority subsystem serviece |
| Griffit | Well not to shit like other guys did i will tell u wot exact virus it is in 2 steps ( in forward sorry for my english aint so good in spelling it ) ok 1 step : LSASS:exe is windows proces and u cant work without it and it isnt virus. 2 step but LSASS:exe can be harmed by virus which is taking some part off your internet conection and bombing some who knows where ip, Many hackers send virus which atack yours LSASS.exe and when LASASS.exe is atcked he is no longer your old windows pal he becomes bad and starts riping your conection all wot u can do is format and upgrade only windows to the last |
| Ellwood | A fake lsass.exe got into my pc and causes a shutdown after internet communication. It appears as though the lsass service just crashes. Put xp sp2 on my PC and no problems since. |
| alex k. | Getting on web, about 1 minute later, a system message appears, the pc will shut down in 60 seconds. Additionally the message requests to close all running programms, as active files could be lost. After 60 seconds windows xp crashs. No chance to work on web. |
| Hercle | I don't know what it is but it is taking up half my cpu usage for no reason |
| rahul | it reboots ur computer and disables the internet / network |
| Murty | Due to this system will shut down within 60 seconds |
| Maham | Critical process for user authentication and logging Read article on Microsoft official site |
| John | People who have nagative comments such as "causes computer to shut down at random".. you have another problem. I would suggest trying a better virus program and firewall. This file is required by Windows and works just fine. |
| Hadi | it become dangerous only when it is not in safe hands, since this file is associated with the windows logon authentiction, so if some one gets control over this file its easy for a hacker to get into your system and he can run any script batch file with out knowing you and this is why we several times see that system behaves randomly as if some one is shuting down or closing applications. |
| Yvo | I only know that LSASS.EXE (not ISASS) will be blocked by Virusscan Enterprice 8.0.0 (McAfee) because its a standard blocking role. Its not clear to me why. McAfee seems to think that its a risk file?! |
| Sad | it shuts down the system in 60 seconds |
| | Kann den Wurm SASSER enthalten. |
| Mustafa Zulqarni | Shuts down the system at anytime. |
| capslock | lsass.exe systemshell, not a virus. |
| faiz the great | it just restart my pc again and again |
| SivertDaHaX | Use protection, then you will avoid diseases! |
| noman | it works depends and shut down the system at random |
| frank cracolice | it knocked out my other computer, and i can't get back in |
| Jonathan | Nothing except it can cause an error that will reboot the server |
| The Illusionist | Hijacks MSN and attempts to spread itself while disrupting Browser and other processes |
| rahul soni | Isass is nothing but it's a type of sassar virus who can easily removed by any blaster antivirus. |
| Matthew Smith smitty86ca@hotmail.com | Not much, but when the 60 sec thing comes up, go to run and enter shutdown -a. This will by you some time |
| Firon | vital security process, patch your system and keep your system clean and you won't have the 60 second shutdown timer! |
| Andres | LSASS.EXE does not seem to be a worm but part of network authentification process; check system32 directory it must be in there |
| mani | when i enter into the net it automatically shut down with status code1073741819. so i am not in a position to use net. and i do not know how to rectify this. |
| DutchKid | This filename is used by some virus (in a different location though) and will be used to execute code. In my case it executed an Iroffer app (IRC XDCC Deamon). Just check the location of the file. If it's not "C:\Windows\System32\lsass.exe" then you should be alarmed! |
| Jesse | i have reformated my computer 4 times and still have the same problem |
| Major Geek | The virus file (lsass.exe) has been cunningly and brilliantly disguised as the system file (lsass.exe). The name of the virus file begins with an upper case or capital "I" (EYE), whereas the name of the system file (lsass.exe) begins with a lower case or small "L" (EL). To an untrained eye, the difference between is visible only if the system font is changed. For more info, check at http://www.softwarepatch.com/tips/isass.html See also: Link |
| SaTeR | as it is found in the operatining system and also in windows updates it does not seem to be a virus file size is 13 312 byte should be fine |
| HHH | Reboots the system at anytime (random) is a the slowing down of the pc is the virus part but the reboot message which u cant cancel is a spyware |
| flyed | if it fails, it makes system crash |
| vishwas | It has to do something with the Security settings for the windows |
| Don | My computer would not load up to start.. Windows system error file name no found. Had to do a complete recovery with recovery disk and lost all my personal information. |
| Tracey | lsaas.exe has come up within a virus check and for all everyone keeps mentioned sasser virus this has identified troj_delf.db as the virus. |
| jörn | isasss.exe wäre sasser! nicht isass.exe |
| | system shutdowning |
| DJA | sure wish someone would just say it in lay man's terms how to get rid of these 'timeout' and computer freezes. |
| Jasper Wammes | This file is just for the graphical interface. |
| Ayhan | its not so dangereous. Hit the internet connection properties and enhance the firewall if you use XP. And the problem is over.. |
| ranjith | This will shutdown the system with error messege system32/lsass.exe,so u need to go to cmd and give cammand as shutdown -a then it wil stop the system shut down so u can download the security taskmanager and run so that it wil recover this error |
| Puffi | Windows System file...when u`ll see again that shutdown message just go to Start- Run and type shutdown -a |
| jimmylfc | its just puts unwanted files in your local disk |
| | it shutdowns IDE of Microsoft Visual InterDev |
| Dinesh Sanas | It's a system file using for logon process |
| Preston Mathis - Certified Computer Engineer | "C:\WINDOWS\System32\lsass.exe" is not a virus/worm/adware/spyware. "lsasss.exe" with the extra "s" in any location is dangerous and should be deleted as it is related to the Sasser/My Doom worm. |
| Hettiarachchi | there is a lsass.exe error,LSA Shell |
| Pastor Don | PC is in a constant reboot cycle - LSASS.EXE - system error "When trying to update a password, this return status indicates that the value provided as the current password is not correct" and then reboots. Cannot F8 into any startup mode without getting this error - safe mode, command prompt, ect. |
| prashant | It just shut down my system after showing me acountdown for i min. flat. V.annoying |
| Maccam94 | It is an essential Windows Process, if it encounters an error or is terminated your system WILL shutdown after 60 seconds and I know of no way to stop that from happening. There are malicious processes under the same name, sometimes you can tell if they're fake if they're under a user name other than SYSTEM. Some viruses also infect this file, but it IS an important Windows component, so don't "fix" it by attempting to delete it. Update Windows to prevent it from getting infected, there also may be an update that fixes the infection. Anti-virus programs should now fix problems caused by Sasser |
| Kusanagi | OS file in Windows XP/2000 as long it is localized in /system32... If not, probably a worm or worse: Sasser! The problem (for the OS file) is to let him outbound to internet or not... |
| Richard | I blocked it in Zone Alarm (access & Server)...no difference |
| prophet | WTF people, it's killing your machines and you don't even know it!! |
| jumbaya | legit system file but vulnerable to attack - so use firewall |
| Vishal | when connected to net it shows timer of 30 seconds and shuts down See also: Link |
| Nitesh | this will shutdown my pc without asking to me. |
| moulaf | this shuts the computer at random and I have to reboot manually. 4 months I have it |
| zed`O | Lsas.exe ist eine Datei von Windows (Probieren Sie es mal zu löschen ;)) holt euch doch Linux :D |
| Udaya | This has been affecting my PC lately by subsequent shutdowns. As soon as I try to connect to the ineternet shutdown takes place after a warning message within 1:00 min |
| Tommi | XP startet bei mir nicht mehr. Es kommt sofort die Fehlermeldung "lsass.exe -Systemfehler" Die Sicherheitskontenverwaltung konnte nicht initalisiert weren... Zu einer Benutzeranmeldung komme ich gar nicht. Auch der abgesicherte Modus bringt mich nicht weiter. Seltsam ist auch, dass beim Booten der primary master nicht gefunden wird, aber trotzdem XP zu starten versucht. |
| Si UK | lsass.exe is harmless, its been said hundreds of times, Its a system process for handling user logins, if u think its a virus or some other danger to your PC, end the process, but you will need to reboot after you do because it will crash the system. And you cant say Isass is suceptable to viruses because every file no just system files are prone to virus attacks, so get over it. Its harmless |
| black | it disable MSN messenger & make system busy |
| Rick | is a spyware |
| John | Interesting it seems to be infecting dvrs and is pair with a mpr file |
| Lou | I had what appeared to be the Sasser Worm, but my system checked out clean. Norton, McAfee, et.al. all gave my system a clean bill of health. After a week and a half, of everything from doing a system restore to an earlier date to doing a Windows repair, I found that my local c:\windows\system32\drivers\etc\hosts file was very obsolete. There is no good reason to have something other than the default (localhost definition) when on a network. Restoring the file to factory values, cleared up my lsass.exe, userinit.exe, and svchost.exe abort issues as I connected to the correct network servers. |
| AB | if u need time to work on your computer before it shuts down go into the date setting and put it a couple of days back. this will give u time to work on it |
| G Patterson | It affect logon |
| 101 | It's really dangerous when is infected |
| KRYSIS | random shut down. this should be either updated or deleted using a virus scan or an advanced spyware scan. it will completely destroy your operating system. so bad that it will not bring up your desktop or any application you may want to run. |
| X | It won't allow me to access my system. I have an active Norton 05 running on my system. |
| Schnitzelfisch | At random encounters (about at least once in 20 minutes, but mostly every 5 minutes) it keeps my system BUSY by drawing 80% CPU load on a PIII-866 running XP PRO. That makes me angry, because that interrupts file transfer for 1-3 minutes (CPU can`t handle I/O's in that time). Sometimes i can set task priority to LOW (that helps), but most times i get an "access denied". I think, this is still part of the XP OS, but IT SUXXX MAJOR COCK!!! |
| | it is a virus |
| | Extremely dangerous. Delete it and all other files in C:\Windows\system32\ or else your computer will spread viruses everywhere. |
| kirk | ive reformatted my computer several times and this virus keeps popping up. as soon as i get my machine booted into windows this thing trys shutting down my computer and een after i remove the thing with a patch it keeps me from installing new software and all kinds of crazy shit. if someone knows where i can find out why this is happening on my machine please post it. |
| Trimay Prasad Aryamishra | I feel it is a file which affect RPC and shut down the system randomly |
| Andy | i seems that when it krashes and tries to restart that it also removes documents folder in my computer and name in start menu. |
| Wild Finn | It starts rebooting immediately when I get connected to LAN, but it's not lsass.exe fault, the worm it self causes the close down |
| K.DHARMALINGAM | This filename is used by some virus (in a different location though) and will be used to execute code,windows\system32\lsass.exe terminated unexpectedly with status code 1073741819, system will be restart with in 60 second |
| splash_ | It's not a virus! It's essencial for nt platforms... |
| | LSASS.EXE or lsass.exe (Local Security Assistant is system file located in C:\Windows\Sytstem32, whereas ISASS.exe or isass.exe is the virus file |
| NeoXC | Deutsch: Also, der Prozess lsass.exe ist in Ordnung, allerdings muss man drauf achten, dass es nicht Isass (mit großem "I" am Anfang) also Sasser ist. Wenn der PC herunterfahren will, einfach auf Start, dann auf "Ausführen" gehen und dort folgendes eingeben: Shutdown -a English: The process called "lsass" is OK, but you have to check, if the process is not "Isass" (with a big "i"), because this would be "Sasser". If the PC restarts, go to the Start-Menu, then start a new Process with the following text: shutdown -a |
| Bladerunner229 | This is NOT a virus. Lsass.exe, a perfectly legit running process not doing any harm. isass.exe, takes advantage of a security vunerability and causes Lsass to shut down your pc. Like others have said, just type "shutdown -a" in run to stop the virus shutting down your pc. |
| | windows process, no dangerous |
| ..:: AvIzOnE™ ::.. | I found that by using 'Stinger' the prob was fixed. I had the Korgo.worm and its that which uses flaws in lsass.exe and RPC to shutdown your machine. To terminate the shutdown, go to RUN and type CMD or Command. then type Shutdown-a. See also: Link |
| DougCooke | OK - I have been experiencing problems for a couple of weeks. Have built up another computer with same spec's as faulty one and put on same network. When firewall reconfigured to send port 80 stuff to new machine, new machine started shurring down with isass.exe code 128 errors. The older computer which was previously shutting down now works fine. !!! Have noted that immediatly before shutdown packets are received from the net. Could there be some form of Hack that is creating this problem. |
| Bimal K.P.G | It is confirmed that the lsass.exe file is infected with a worm, probably a Sasser. The lsass.exe is a System process file, but you cannot expect a system file to notify you that the system will shutdown in 60 seconds, its ridiculous. I have run one of the Symantec fix tool, but the issue persists. However, there are other variants also, but i couldnt try those. When you receive this alert, type Shutdown -A at the Run box from Start menu. This should help you. |
| N8 Ting | Said lsass.exe was missing, then asked for password.. problem is there was never a password to begin with. 2nd time with this problem. First time we did a clean install, same with second. Should I expect this to happen again, and is there anything I can do to permenently lose this problem. I have a current anti-virus and xp firewall. I connect to the internet through a wirless router. How did i get this and is it the sasser worm? |
| rude1 | What i dont understand is everyone wants to argue, its a virus, its a system file, but the fact remains, i still get the error on boot and how do i correct it. if you dont know, why post your comment unless asking for help. i am looking for info like, restore from the repair option off the system disk or copy the file from another computer to the system32 directory, anything but mindless talk with no solution. |
| pmmelfisch | dieser scheiss stinger nützt nichts hat nichts gefunden, jetzt lad ich mir von einem anderen pc mal die updates herunter und patche den pc mal, ist echt der hass mit win2k, an alle anderen emfpehle ich systemwiederherstellung die xp haben an das datum wo man ihn noch nicht hatte, start, programme, zubehör, systemprogramme und dann systemwiederherstellung zum zeitpunkt als ihr das geschwür noch nicht hattet. |
| Chris | lsass.exe is apparently modified by a Trojan Horse named TROJ_HOLAX.C. This seems to be a new Trojan which is not known either with microsoft oder any of the common Antivirus Programs. In my case it was quarantined via TrendMicro but, anyway it affected most of our servers. The lsass.exe is shutting down my systems, I didn't find a solution yet. I would be grateful for any information |
| Escaflowne | Teil II ich habe gleich darauf mit symantec trace gemacht und es hat sich herausgestellt das es mein cabel internet anbieter ist. so stand es zumindest in den details. sein sitz ist in münchen, aber das fadenkreuz war auf bundesland brandenburg gerichtet. beide programme sind nicht Microsoft signiert und geben sich als wären sie das aus. |
| Mickey | turned up in an error msg when installing XP. System seems to have hung on installation after viewing this error. "The application or DLL C:\WINDOWS\system32\SAMLIB.dll is not a valid windows image. Please check this against your installation diskette" |
| ME | at the end no one answered the damn question. of this stinking lsass.exe, I have the same thing happening to computer ever at starting to boot with a disk, it tells me that there was an invalid parameter was passed to a service or function |
| mukesh agarwal | This file is created due to infected by virus.The system warbns you you to savethe files and it will be shutting down in next 60 seconds.Though bnot dangerous it makes me feel irritate when i am in mid of some important work. |
| NEO | When i try to get back to windows it comes up with system error Lsass.exe and below it, it says "insufficient resources to start API" how the hell do i gt rid of this so i can get back on my computer? |
| NEO | When i try to get back to windows it comes up with system error Lsass.exe and below it, it says "insufficient resources to start API" how the hell do i gt rid of this so i can get back on my computer? |
| BIG G | if your computer begind to shutdown go to run then cmd and type in shutdown -a and it will stop it but only do this while you are virus scanning or it could leave the virus on your pc |
| Sevel | my current problem is, that my computer wont even restart. It only shows a black screen after rebooting and tells me that "isass" couldnt been reinstalled..is that the worm too?:( |
| Cristian Ali | Con "shutdown -a" ejecutado desde "Inicio" - "Ejecutar" resuelves temporalmente el problema, aunque no sé las consecuencias de mantener funcionando el PC. |
| mack | I am facing lsass.exe problem from last 2 month if and one know how i can resolve from lsass.exe problem please tell me at callingtomanish@yahoo.co.in |
| josue | Very difficult to remove, because is part of WIn2K system =S. That's why, use Linux, Solaris, MACOSX, uff, everything but not windows..... |
| IG | This is really shit it just reboots ur computer when u go to the internet and my symantec cant remove it and not even my virus scanner!!! |
| Jacob | My lsass.exe is not a virus (I have sp2 and Norton), but the problem is that it works continously, accessing the disk. How can I stop it? |
| God Cheese` | Just having the same difficulties that everyone else is on here... its "unexpectedly terminating", and shutting the comp down |
| Gunjan Pandey | This FIlename is used by some virus & due to this the system shutdown rapidly and also no network path is found |
| Aaron5367 | Not a good file to have, but dose host a home for viruses occasionally, quarintine and see if you can remove. See also: Link |
| Kiran | it shutdowns my windows and restarts thus creating a great problme when i was in a important work |
| tex | Have a question--lsass.exe is in my c:\i386 and in servicepack and in system32...safe or unsafe? |
| Indra Sukmayana | jiganamah virus ieu mah, soalna komputer win2000 server urang restart wae, keuheul pisan. |
| Afolabi | it shuts down system randomly and destroys exe files of othe applications |
| Gunjan Pandey | System restarts frequently and does'nt creates the network connections |
| Chris | lsass.exe is apparently modified by a Trojan Horse named TROJ_HOLAX.C |
| BG69 | if it is anywhere other than windows /system32 remove it |
| Isass is evil... | Help me! its completely destroyed my computer! BEWARE!!! |
| | if your computer begind to shutdown go to run then c |
| | computer go pzffffff when it turn off See also: Link |
| Lokesh | it doesnt make the computer to boot See also: Link |
| SARSSER | I think it's on my computer... |
| Jacob | lsass.exe is not a virus |
| noname | Einfach mal googln'... See also: Link |
| JMR | there are TWO files that look the same Lsass and Isass. Lsass is the Windows exe and sits in the C/Windows/System32 folder, and isass oftern goes to the SYSTEM folder; C/Windows/System. Use View/Details to place files in an alphabetical order and ONLY remove the isass (Because of default fonts you must list the files alphabetically. To remove usea programme like Gipin Softwares Move on Boot which will remove ANY file that will not delete. Mostly you do not need to reboot. Once you have selected delete on next boot the file can then be right-click / deleted immediately See also: Link |
| Roger | There is also another file named "lssas.exe" Pay close attention to the spelling of filename......anyway i go into taskman and end all process that i don't want anyway......this is one of them. sometimes runs multiple instances at the same time as well so make sure you "End Process Tree" for both if they appear......I HAVE NEVER HAD A PROBLEM LEAVING IT OPN SYSTEM AS LONG AS I END IT AFTER STARTUP!!!!! Also run task "msconfig" and you can choose not to have it start with windows :) |
| Brainiac | Put in a firewall to get most of the problems fixed. Or use the Windows Firewall, it is present in pre-SP2 also, it is named differently. Use Stinger from the McAfee site. Then use Ad-aware and spybot, it solves other issues also(If your system is affected by this old a virus, it will be affected by spyware also. To get the run command without using the start button, use the combination of the Windows key and 'R' together. Then you can use 'shutdown -a' to abort the shutdown. See also: Link |
| | I know that this file is properly referred to as Lsass (and I know better than to refer to it as lsass.exe w/ alower case L). And I know that isass.exe is a malware file which is NEVER to be referred to with an Upper Case "I" (i), which is indistinguishable from the lower case l. (L). If all who wrote about these files consiistently used Lsass for the Microsoft file, and isass for the malware file, much pain and confusion would be avoided. |
| A Person | Very dangerous virus no matter what anyone says. It is both a Windows process and a virus so it can be misleading. It has wrecked one of my computers and has forced me to format another. If you ever get this virus, your best bet is to make a parallel copy of Windows (if at all possible), then copy impotant files onto disk. Afterwards, format your machine entirely. It has come back twice for me and it's a load of trouble. |
| allemirra | i am using windows 2003 server and having problem with lsass.exe and shution down the server within 6x seconds then i have set the permission this file to deny to admin then i restart the system but system could not restart it is hp server ML 150. how can i get it back my system any clue? plese help me to allemirra@yahoo.com |
| Ownsya | this is the vuln that the sasser 445 and 139 attacks. also this image name is commonly used in many rootkits and backdoor servers. just have a good av and firewall installed and you should be fine although having said that i have got past norton security recently with this vuln with rBot. So be carefull. :-) |
| alfred | there is a difference between Lsass.exe and Isass.exe. well its actually 'lsass.exe' and 'Isass.exe'. but while the first one is typed with a lowercase L, the 2nd is with an uppercase i. which looks the same. the L one is safe. don't delete it. |
| kuki_furuya | It is a virus or trojan or whatever it is, it must be annoying! No, doubt! I got my Windows shuting down in countdown of a few seconds, while I was starting connected to the internet. May Al-Karim always protects me from such disassters!!! |
| Josh | This file seems to be hogging all CPU, when I go into task manager it is using 90+%, So IE slows to a crawl, anyone have any ideas? I installed XP only about two weeks ago and it worked fine for the first week Thanx |
| | Thank you ..:: AvIzOnE™ ::.. Though I've thought this may be related to the PRC thing, I didn't think that they're directly related. My problem is that whenever I start MSN it will terminate wityh status code 128. See also: Link |
| Halgasm | don't confuse a lower case L with an upper case i when looking at the file names as one file is a virus and the other is a windows os file for security. this is a clever trick to hide the true file name |
| worlay | It disrupts my cool computing by shutting down at random. I found it 's a worm that attacked one of the computers on my network. After dealin with it it has not come back |
| Tim | Well if it is not running from the System32 then it is the sasser worm, as long as its running from System32 it is harmless, all it does its validate Windows User Logons |
| Crazed Maniac | I know nothing about this but my PC won'y let me in, i've looked on this site for help only to read about your moans and grissles. Can't just one of you dick***ds help? |
| Tommo | Your machine does not need to be infected for you to receive a shutdown message from lsass. Its a sign that a remote process is doing an attack against your PC. See also: Link |
| n_bre | lässt sich nicht löschen, auch nicht durch umbennen. Lässt meinen PC herunterfahren und neu starten und das obwohl in system32 oder gerade deswegen! |
| Edsel | it is actually a system file used by the Windows System being exploited by Sasser , a variant of Plexus, that restarts the PC every few minutes. |
| Gaurav Julka | virus is having the same name as this file.. that is confusing and dangerous for the users. may be virus using this service too |
| lokesh | it shut downs my pc by giving waring before 60 seconds automatically.how should i overcome this problem, can any one suggest me |
| Moagi | I have just got the virus it just shuts down my pc after a minute countdown and gives lsass.exe errorcode 128 |
| Macintosh | It shuts down my computer with a 60 second warning. Download of direct x failed at 99%(dial up) |
| Chandra | I think this is a virus, it's slow down the PC and call RPC to shutdown the PC in one minute. |
| cüneyt uğur | i think it is about system secrutiy on ethernet card, or other card's configration error. |
| mathanraj | used for user authentication, but i automatically shutdown the system at random |
| dia | this file is very crictical it just shuts down your computer very quickly |
| Death by sin | use RUN command and type shutdown -a to stop RPC block ports 135, 445 |
| chad | OK! I understand it's not the virus, but how do I get rid of it?!?! |
| | causes system to freeze, roboot over & over. c/c roms will not read |
| KruG3R | it shuts my computer down within 60 sec. :( i hate windows :D |
| bob heinbokel | i cant find it in any folder or system32 folder or anything.. |
| anti-lsass | everytime i start my ie, my computer shut down in 55 sec. |
| Joe Zhao | Isass.exe is a worm, and Lsass.exe is Windows native |
| stephen | randomly gives me an error and restarts my computer |
| Rogelio | This isn't a virus, is worse, is a windows file!!! |
| Ning Cao | it is from Microsoft. It keeps reading and writing |
| Private Ryan | I believe this file would be a window process |
| doorkeeper25 | nicht gefährlich, aber einfach nur nervig |
| eggi0296 | Völlig harmlos, wenn im Systemordner |
| Paul Martin | I have bee facing same problem a you See also: Link |
| | its is very danhgeroiusprasjesh |
| rr | cause shut down in 60 secs |
| Ahmed Mamdouh | it is not a harmfull file |
| Joe | Not a VIRUS |
| sasservictime | i am infected with this worm |
| JC | it is a bad one... it lurks within your network... tip: when your frustrated... before reformating a networked pc... kindly pull off the lan cable first.. to keep it inside and keep others out. |
| Ron | Repair for error that stops you from booting from this system - not virus program is knowledgebase 307545 at microsoft See also: Link |
| Mekatrig | Isass.exe is an upper case i. lsass.exe is a lower case L. Virtually indistinguishable huh. More and more harmfull stuff is being sent out with window file names, using1instead of l, I instead of l etc..... i would advise you all to set your default font to sans serif or any font which distinguishs between letters. isass.exe is a trojan loader, very very bad, Lsass.exe is the usedr authentication process, harmless but isass.exe buggers Lsass.exe so eventually it fails to reconise internal passwords and prevents your OS from starting. I've just thrown my laptop out of a 6th story window. |
| muse | this virus is so dangerouse and make me to waste my time seraching it's solution |
| Buto Man | it keep rebooting my system after some fiew minutes. this happens when i connect to net. i have just reformatted my PC but still having the same problem |
| Ionutz | For 2 weeks i try to fix it. i formated my PC for many times. isass.exe don`t let you to use a firewall or a antivirus. I don`t known what to do :( |
| Foga | shutdowns my windows and restarts . I'm very engry. I have Bitdefender, I have a good firewall, a good Spy, and it continues to restart my computer. |
| UnEmploymentDude | Everywhere Claims It To Be A Windows App, But When I Didnt Block It From The Net, None Of My Internet Required Applications Worked. |
| girija | it a very troubling exe as it frequently reboots the computer |
| | It is a SYSTEM file, which is absolutely not harmfull it self. however multiple virusses abuse functionality of it, or render this program instable. This has caused a lot of fals alarms! |
| law | my computer cant boot!!it keep on saying missing lsass.exe!! |
| pawan srivastava | lsass.exe is not a worm or any virus it's a os program file but sometimes it can deactivate from services rpc |
| LEAVE IT ALONE | It's a system file. What are you going to do; delete it? Lsasss.exe (the virus) has an extra s on the end |
| Smeik | Download stinger programm to remove the virus See also: Link |
| HalloBallo | Bitte verwechseln Sie die lsass.exe (LSASS:EXE) NICHT mit der isass.exe (ISASS:EXE). |
| Alucard | It's a security update for outlook and windows I'm not a prmotor for norton but if you have good security set up programs like trojan guard, zone alert or norton you will not be infected by sasser or any other virus |
| Arun | When the system prompts shutdown, go to the right hand corner and modify the date by one year. the message will then show you that your computer will shut down in 365 days. now you have a lot of time at your disposal to think about the problem. |
| Tony | lsass.exe is not a viru. However, it may have a Trojan virus attached to it. W32.SPYBOT.WORM CAN ATTACH TO IT. Norton and Sophos will not remove it directly. Reboot into safe mode scan c:\windows\lsass.exe if trojan still there Norton should then remove it. |
| Kat | Read the note! c:\windows\System32\lsass.exe is not a virus. Other verisons of lsass.exe (different directory, different capitalization on the file name) probably are. We are talking about the windows process in this web page, not the virus! |
| emmanuel | I recently had an encounter with this lsass.exe with my WinXp. Then after 60secs, it will reboot my Pc. I did a reinstall of the OS. What takes place now is that when the shutdown process as initiated by NT AUTHORITY\SYSTEM occurs, my Pcs dont reboot at the expiration on the counter but all other drives like the floppy, cd will cease to work until I now I shut down and restart the PC. |
| Matto | This file is not the problem, the problem is a worm that has infected your computer. I did what I was told to at the site that I have linked and my system is functioning normally again. Good luck. See also: Link |
| Ankit Saxena | Lsass.exe is a file which starts a process responsible for generating an authentication token. Its not a virus. A virus ( idont know its name) hinders the token , and authentication fails. Therefore a restart is initiated by Lsass process. See also: Link |
| Cüneyt UĞUR | I Solved it to install sp1 and i guess this reason is about some trojen or virus come from internet when i look crack :) |
| erni | r u tired of all these advices... i was ;) |
| hyde | The file lsass.exe in windows\systems32\ is infected because this the windows service and the anti virus products is update little so that most people have one kind of virus |
| Dinger | If your computer keeps rebooting due to lssass then go to the symantec website and download the sasser worm removal tool. It worked for me. |
| Charmaine | When I had norton I didnt know that this file existed, I uninstalled Norton & installed Avast and since then Avast has been blocking it. |
| GOD | Honestly people, it aint a virus, Do some research on computer files and find out for yourself. Do not believe what you read on here, some are true some are not. If you get a message reading you computer will shut down in 60 seconds. download the tool to get rid of it. |
| vbnmgjk | -it roboot my com without notice if im playing games... |
| Shalianahe | as fromt the top of the page here :-- lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token for them that says it a viruse are scare mungering, yes if it fails ur pc will shut down, See also: Link |
| | Vital for windows. Very rarely causes a lot of disk activity , but I think it's nornal. |
| Zafar Alam, SMWT | It is a windows system file. It random shuts down the PC which causes loss of valuable data. Bother the users. Destroy CDs/DVDs in Burning situation. Needs immediate solution for all OS. |
| Aamir | I hv experienced first time, it is very dangrous when u hv to save many files, a lot of data can be damaged. |
| | Lsass.exe ís obviously a windows process. But the vulnerability of it makes it dangerous. isass causes annoying problems, like not even being able to start windows. How can I fix it when I can't get windows to start (not with a system restore or in safemode)? |
| Gerard Way | thank god. not a key logger |
| Lisa | it randomly rejects memory and shuts down computer. |
| Master Wallace | man kann einen PC über den shutdown befehl hinunterfahren |
| Ozan Dogan | it force system to shutdown |
| devotee | some time virus like this (or not) shutdown my computer automatically |
| Scooter | Legit file / process however, if it's been infected or replaced, even a new installation impossible as you cannot even generate a working OS Shell to login to. Apply the necessary security updates and protect the file from infection / replacement. I have a copy of Win2K Pro and the install copy has an infected lsass.exe file so you can't even install it period. |
| alien13 | Hi, i started having this problem awhile ago but never go the message.... it just kept restarting as sonn as windows loaded.... i tried a fresh install and i cant finish it as it keeps giving this message... what can i do :( any help is really appreciated |
| Jordan | System security logon |
| Cüneyt Uğur | This problem is about trojen you can solves it install sp1 for 2003. and you can use this command on run "shutdown -a" to prevent shutdown |
| Ramesh N | If broadband cable is connected then only this "Lsass.exe error windows shutting down in 60 sec" error is coming since DNS server trying to login our PC for verification and our machine is verifying login user this conflict is happening. Still I am searching solution for this. |
| Salim | its a critical windows file but some time infucted with trojan. you have to turn of the system restore for root disk partation and then restart the PC and during the restarting keep press the F8 and chose the " safe mode" and then run your antivirus scanner and also microsoft anti spyware to clean infacted files. |
| sanjeev | well this file or .exe is not so dangerous as it is considered, before coming to a conclusion we have cheke whether the lsass.exe is runing or not that local security authhentication server,after that chk it tin the c::/windows or c"/winnt. |
| netaces2k | The lsass.exe is a genuine part of the Windows XP operating system. It is neither a virus nor is it harmful. That doesn't say that someone either has or hasn't figured out how to misuse, or potentially abuse it. Most criminal hackers will do anything to harm or damage a users computer. But, the basic files and programs that come included with MS Windows are harmless. See also: Link |
| Ken | I only know what I've read here. Not much inf. |
| Ape | It forces a shut down on your system when connected to any intra-network |
| pratham4u2002 | it is a file required for networking purpose in win 2000 and xp but is sometimes overwritten by worms n trojans in the same name lsas.exe located in c:\windows\system32 which then affects system's performancemakin it unstable. When the file is overwritten by worms for example BLASTER it fcontinuously fres error regarding REMOTE PROCEDURE CONTROLLER and makes stystem to shutdown in 60 seconds. do contact me for further queries |
| macbord | forma part del sistema |
| ujwal | some virus got attacked.so my system gets shutdown in 60 seconds some times. |
| harrister101 | thaught it was virus but is something to do with logins |
| chandan | cause shut down in 60 secs |
| Kisara | *sigh* People, it is NOT dangerous. It is a system file. Try disabling it in Task Manager and just see what happens. The Sasser worm has a different filename. The shutdown is probably a corrupt registry key. See also: Link |
| Mechpaladin (Vernon Chan) | The lsass.exe fille which is mentioned here is an important windows file. As long as said file is located in c:\windows\System32\lsass.exe it's the real file. The lsass.exe which shuts down users PCs is the W32.Sasser Worm. To prevent this problem, download and install the KB835732 patch from the microsoft security bulletin MS04-011 page, & enable the firewall in your network connections. See also: Link |
| | If this file is corrupt our AD is corrupt .Imagine your are working on server and all of sudden you have error"your server will rebot in 5..4..3..2..1".bang.In that case we need to repair it refer KB258062 See also: Link |
| sendil velan | is not so dangerous but still doesnot allow u to work properly |
| Jim | Bestandteil von Win2000 und WinXP, hat allerdings eine Schwachstelle, die über das WindowsUpdate geschlossen werden kann. Wenn sie nicht geschlossen wird, öffnet man dem Wurm Sasser alle Türen |
| Eierschädel | Lässt Explorer abstürzen |
| Ritesh Bhardwaj | Lsass.exe file is a virus and Shutdown Systems Automaticaly. I have already faced this Problem. My OS is windows 2000 and Used shutdown -a but it not a suitable with Win 2000. System Restart after 60 Seconds. so I am not able to work on my System. |
| gurpreet | it restarts the computer after few minutes |
| Syflop | I dont know much.. But its a REAL PAIN when im working , and it says i HAVE to reboot my pc due to an error or something, im getting close to calling microsoft about it, Its driving me mad, Paying $300 for windows 2003 and getting errors and other stuff |
| john Doe | do not know about this file but some dumbos like me thought it was the isass ( the one which begins with i not L ) but wasnt. |
| uday | problem at startup |
| Andrew | i kno that it restarts your pc and only gives you 60 seconds to save everything |
| Brendan | DO NOT DELETE! removing this file will cause windows to stop functioning it is required for security authentication, if your machine is shutting down chances are you have the sasser worm, see symantecs website for details on removal |
| Samuel Devadoss | security while entering into network |
| Knute | Appears out of now where, Good firewall will stop it. |
| lory | also ich glaube schon das lsass.exe ein virus ist mein pc geht immer aus nach paar minuten,aber seit dem ich ein guten anti-virus programm habe net mehr |
| Filip Baba | Its dangerous when you got a blaster worm, when ever you go to the internet lsass initializes a shutdown of your computer. |
| | Just a windows file. If it reboots your PC you are infected by a virus (also if you have a new computer, you just need to connect to internet to get the virus) |
| FEHINTOLA SOBUNKOLA | when browing it logs you off and reboot the system |
| Abhishekmathur | local security server |
| d. | some spyware removers can order you to remove lsass.exe. Only do so when it is not located in win\syst32\ otherwise windows wil not start the next logon. |
| | It'll completely disturb my work and will always shut down every system that i'm using. I'm a freeters that usually working with the computer and this worm cannot be removed or deleted as i've tried before... At the end, I need to reformat my computer and reinstall all the software i want to use.. |
| RedRiver | Window system file. Not a problem! |
| | LSA Shell (Export Version) has encountered a problem and needs to close. We are sorry for the inconvenience. |
| 11 Jordi MannSlayer | It is very irrtating. As you go online, after sometime, the reboot dialog comes with a time span 60 seconds. Thing is you can't even terminate this app. I am using Win 2003 server, someone suggested me to go into COMMAND mode Use command "SHUTDOWN -i " and set the time = "99999" but I found out the "OK" button Grayed out .! |
| Leow | Important windows process. Only gets the shutdown notice occassionally when the virus tried to get in.After rebooting works perfectly fine for about a few months |
| Sydney | I cant log in to my computer it says It is missing Lass.exe and when i click OK it restarts. |
| Michael | The "System error: LSASS.EXE" error may occur because the OOBE cannot reset the Machine registry key before the computer is restarted.1. Start the computer with a Windows XP CD. Enter the recovery console by pressing the R key, and then logging into Windows. Doing so opens a command prompt. If no administrator password exists, press ENTER. 2. Type the following at the command prompt: cd D:\i386 3. Press the ENTER key. If the error "The system cannot find the path specified" appears, enter the following paths, in order, until the error does not occur: cd D:\Windows\i386 cd C:\i386 |
| Tibo | Win user verifying. Meldung erscheint, tut aber nichts |
| Dayonick | Es un archivo verificado de windows |
| Ryan | This is not a dangerous dll, it is necessary for the Windows operations system. It is not to be confused with the worm, which looks the same. Look: "Isass", "lsass". The first one ther is in fact a capital "i", not a lowercase "L". If it is spelt with an "i" (or any other letter, for that fact), it is the worm, but if it spelled with and "L", then don't delete or stop it, it is nesessary. |
| Phaneendra | it is not a virus or any. this is system file this problem is windows file (lsass.exe)file is unable to process, or the file function is incorrectionly some causes.causes are I don't no. |
| Xwassac Studios | I am a CompuITA Certified Virus Inspector, this program is not a virus |
| No name | runs ping.exe multiple times and shut downs the computer where i do cmd or msconfig or regedit |
| i know all | the file "lsass.exe" is NOT a worm. "lsasss.exe" IS a worm called the sasser worm which takes advantage of the vulnerable lsass.exe process. do NOT stop this process |
| Teehee | I have no problem with this file in Windows XP. However, on Windows Server 2003 with IIS installed, this thing keeps restarting my dear little server, which connects to some twenty clients. It's not a virus. But there's a bug inside which brings up the problem. |
| Masud | ISASS.exe: An invalid Parameter was passed to a service or function, How can I solve this problem? |
| earamosrico | It constantly uses the 500 UDP port,, could anyone please tell me if this behavior is correct? |
| Naseer | It appears suddenly and it shutdowns my system within 60secs and when my system reboots it again reappears and says it will shutdown again.I am fed up of this and I formatted my system completely. Its definitely a dangerous virus.Make sure to stay away from this harmful virus.It is definitely a virus only as no system file will ask you to shutdown abruptly within secs again and again. |
| Josh | if it keeps happening just create a new batch file with this code: ":START" (newline) "shutdown -a" (new line) "GOTO START". then run it and the computer wont shut down |
| atokfly | shutdown randomly(winXP&win2k) - 'windows\system32\isass.exe' terminated unexpectedly with status code-1073741819 -just need to update ie n run windows update |
| David | If you find a PC that has a clean copy of the lsass.exe and msgina.dll, copy those files and overwrite them into your windows/system folder...problem solved. |
| Edward R. | It is a windows component but when infected it causes much trouble shutting down PC automatically after 30 min. period, process closed by NT/Authority it's still giving me trouble I have Avast! Antivirus and have run the patch in Windows, still not removed it might be some kind of worm called blaster or sasser but cant clean it yet, I consider it's dangerous. |
| Borz Sergiu | It's a WinXP vulnerable procces, he can execute remote functions, it get's infected by trojans. Can be fixed by updating windows |
| Dayanand.J | we have experienced this issue in win XP, for the temporary solution, we give shutdown -a in the cmd prompt, how to troubleshoot in win 2000 prof. |
| Iftikhar aziz | this file lock your computer if u leave the computer for more then 15 minuter.then u must restart. if u r adminstrator of the computer |
| Rissacher | Don't confuses Isass.exe with Lsass.exe, under the right font they look the same. "I" is the virus "L" is a real system file |
| b_sohns | Standard-Systemdatei unter Windows XP |
| Maur | This is the Local Security Authority subsytem, responsible for authenticating users on your system. Services such as Net Logon and Security Accounts Manager use it. |
| bapin | whenever i connect my ethernet cable to my pc, an error pops up with some error code which shuts down the computer within 60 seconds. |
| Rubel | This file is not a virus. I think virus is isass.exe find it first. |
| Pathan Nisar | This is system file not it is used the xp if we can't be deleted and it self replicated file so don't delete it if it runs pls run the command Shutdown -a it shop the lsass.exe then you logoff the computer and the shutdown it |
| Madison | I'm infected with the Isass.exe worm. I'm not even able to log into my user, so how can i remove the problem by scanning it since i can't even start up any programme. Please, i need help here. |
| spirokimino | To my knowledge, lsass.exe is NOT dangerous. DO NOT DELETE IT. I was infected with the sasser virus, and I deleted lsass.exe to try and fix the problem. Well, all kinds of hell that caused. The computer, when started/rebooted, simply gave me a black screen. As cute as that may sound, it's kinda annoying when you can't get into the computer at all. Remedied this problem by fiddling around a lot, installing a new trial-based version of Windows, replacing the file and deleting the temporary OS I created. I would reccommend NOT deleting that file. Rather, open 'RUN' and enter "shutdown-a". |
| PLY | Everyone with arrow all the way to the left has a clue, any where else, you're confused....(c; |
| Caleb | When I got isass.exe I ran a boot time scan from "avast antivirus home edition". So far it has cleaned the virus out.... I recommend Avast Home Edition (free) because of the capabilities of a boot time scan. You can download Avast at the link I have included. See also: Link |
| steve | only what i read tonite and the last time i tried to log in i got a warning someone had accessed some of my files |
| Arnco HELMI | Creator = Microsoft / Windows = Local Security Authority Subsystem Service |
| Arturo Lorenzo | Freezes windows xp sp2 when running mcafe 8.0 enterprise memory scan |
| | lsass.exe not a virus.its a molwer or spyware.if can be remove by any antispyware software of antivirus. |
| | This is the local security server, it's not a frigging virus, by it or any other name; it is REQUIRED to run your pc, if you get the message that it caused the system to reboot, it is because the sasser virus crashed lsass and your PC is rebooting as a result. IF YOUR COMPUTER REBOOTS STATING THIS YOU HAVE SASSER. |
| Williggin | Local Security Authentication Server Win NT4/2000/XP/2003 verifies validity of user logons to PC/Server Important part of OS path is C:\WinNT\System32\LSASS.exe (WinNT/2000) C:\Windows\System32\LSASS.exe (XP/2003) |
| | systemdatei |
| dan | it has password and login info in it,,and it accesses the net,,its prohably needed but i can see exactly why the lsass virus targeted it |
| mirna | LASASS.EXE its coming with the windows xp , 2000 ... so its not a virus but its better to block it by the firewall and its ok |
| Linux For the win | A system File, (incase you didn't read the previous million posts) not dangerious, but essential, confused with isass.exe by the sasser virus, it you have it then download a anti-virus program to get rid of it such as Avast free, avg free bitdefender etc. Also, make a batch file with shutdown -a in it and then put it as a quickkey, so that it will not shutdown durring the virus removal |
| UTP | It restarts when u run .exe files especially antivirus software and .txt files. |
| john | Authentication process apparently requires disk I/O every second or so 100% of computer "on" time. It's a hog. It shouldn't require so much resource. |
| Julia | lsass.exe = Local Security Authority Subsystem (kein/no virus) |
| | Is required to make an internet connection. If you stop the service it will timeout and restart the PC for security reasons! |
| mrsiwy | isass.exe or lsass.exe 2 different things but people think that is the same that;'s why is so many problems See also: Link |
| TeeJay | lsass.exe is a SAFE and required Windows security process, do not get confused between this and lsasss.exe - which is the sasser virus |
| Astrocom | lsass.exe can hide elements of W32.Virut.A & PE.Virut.A. It will appear as IEFilter.dll & process 236. The best defence is a recent mirror backup, because it can also corrupt safe mode access. |
| Kristin | i have this on my computer and there is no problem with rebooting at all or anything. |
| Stelf | strange process, seems to be killed at random if there is any winxp system in the LAN, zonealarm solves the issue, but not the problem |
| Get a Grip | You will regret deleting the file if you choose to delete it. It is safe by itself. |
| dust | leicht rauszufinden ob Virus oder Windows :). Einfach suchen wenn es in Sys32 is dann is es normal wenn sie woanders ist löschen ^^ |
| Peter | LSASS.EXE (c:\windows\system32) is a part of Windows; ISASS.EXE placed else is a virus |
| Alex | This can be exploited by bots remotely and can hide the trojan process from being displayed in windows task manager, Resolution : update SP2 and ensure you kill all unknown processes using Security task manager! Keep safe! |
| Berry van Zanten | Some one says it's a Virus, another one says its a system file. So I did some research, and found that it's a system file. but I'm getting crazy from my mcafee telling me "Trojan found" if I say "Delete the infected file" everything will be fine, however the virus comes back if i go back to the internet, Please Help |
| Paul | LSASS is a vital process, but watch for the file "isass.exe", this is a trojan. Intruders try to make this file look like the original Lsass |
| | sometimes viruses tend to diguis themself. |
| gary | well i know its on every computer made by microsoft. this cant be a worm. or it wont be on your brand new computer, its a worm |
| ronsolostar | it comes up on startup then when i go on the internet I just delet it |
| MICROSOFT | The Lsass.exe process is responsible for management of local security authority domain authentication and Active Directory management. This process handles authentication for both the client and the server, and it also governs the Active Directory engine. The Lsass.exe process is responsible for the following components: • Local Security Authority See also: Link |
| Maniac | The file is harmless. I got it with my new comp, from a reliable computer store. Perhaps this sasser worm thing just exploits the lsass.exe file in some way. |
| Daniel Farst | The Local Security Authority Subsystem Service - Critical Windows service. It controls the security subsystem. Crashing this process will cause your computer to automatically restart. See also: Link |
| NOT A VIRUS | lsass.exe is not a virus. It's the isass.exe that is a dangerous virus that cause your computer to shut down in ca 60 seconds. SO STOP SAYING IT'S A VIRUS |
| Alan | I learned that lsass.exe might be harmful from McAfee |
| concerned | lsass.exe (Lsass.exe) tried to open a server connection to Mexico (traced IP with NeoTrace) shown from my ZoneAlarm program, why would this Harmless Program be trying to open a server connection to IP# 189.155.117.25 |
| kev | be carefull. obviously if its up your computer and crashes unexpectably, its gonna be a virus. however... i have isass.exe on my comp and have had no problems with it, untill i tried to get rid of it. seems legit |
| Tekchand | This is a part of windows server 2003. sometimes it causes problem with etrust antivirus. |
| Ben | If you have less than 128mbRAM then you will have trouble updating your computer. Put more memory in your computer and try again. |
| Rick | Lsass.exe a vital part of windows. NOT A VIRUS - If the last thing you did was a spyware removal eg ran spywarestormer then boot from windows cd and choose repair a windows installation this will actually work - if however if you do have the sasser virus then obtain stinger from mcaffee or the symantec equiv and run this tool through safe mode by pressing F8 at startup - the virus is detected and removed reboot normally and installed antivirus and firewall then update them - If you have played in the registry or have a damaged hard drive then delete partition and start from scratch See also: Link |
| bad bob | Its a windows security file. It does not cause all the reboots but it does get crashed by the sasser virus which causes the 60s till shutdown thingy |
| | lsass.exe is not a virus. It's Microsoft's one of its gifts that came with Windows. If your computer reboots stating "lsass.exe", then you're bad luck because you got a virus in your system. :-( |
| Yazdi | This is not |
