What is lsass.exe? Is lsass.exe spyware or a virus?
How to fix lsass.exe related problems?
1. Run Security Task Manager to check your lsass process
2. Run a Windows Repair Tool to fix lsass.exe related PC problems
3. Run an Antivirus to find persistent malware
Process name: Local security authentication server
Product: Windows
Company: Microsoft
File: lsass.exe
Security Rating:
"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC or server.
Lsass generates the process responsible for authenticating users for the Winlogon service.
This is performed by using authentication packages such as the default, Msgina.dll. If authentication is successful,
Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates then inherit this token.
Note: The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
Virus with same file name:
W32.Nimos.Worm - Symantec Corporation
W32.Sasser.E.Worm (Lsasss.exe) - McAfee
W32.HLLW.Lovgate.C@mm - Symantec Corporation
Click to Run a Free Scan for lsass.exe related Errors
Users Opinions
Average user rating of lsass.exe: based on 759 votes. Read also the 655 reviews.
9686 users ask for this file. 290 users rated it as not dangerous. 30 users rated it as not so dangerous. 142 users rated it as neutral. 86 users rated it as little bit dangerous. 211 users rated it as dangerous. 74 users didn't rate it ("don't know").
| All comments about lsass.exe: | |
|---|---|
| it works depends and shut down the system at random Altair | |
| Microsoft Local Security Authority Service: Windows critical process for user authorization and loging Martin | |
| windows crashes by the sasser worm. When it is infected it doesn't run neither regedit. anthony | |
| symantec associated the "sasser worm" with this Anthony | |
| Part of the Windows OP system Lisa | |
| As before has been mentioned, a completely innocent system process and a dangerous virus come with the same name. No need for panic but keep your eyes open. Virus removal information can help determining whether you're dealing wtih fake lsass.exe or not. LordScav | |
| PC shuts down the system with code 1073741819 See also: Link Mark | |
| It is required for Win2000 & XP to work. Viruses (Sasser) attack it! Joe | |
| If you have the Sasser worm: abort shutdown by going to run and enter cmd, then type shutdown -a, make sure you update windows entirely See also: Link thanks | |
| Computer reboots at random, patch helped immediately Robert | |
| When I'm connected to the net. it times me out and reboot my computer Antonio Bell | |
| This file has been causing problems lately... it keeps on "terminating unexpectedly", so the whole computer has a system shutdown in one mintute Githoniel | |
| There was a virus in my pc with the same name. Whenever I enter to the net it infecting in 20 seconds. I cleaned it very difficult by updating windows security and using special cleaners for this virus. Mehmet Ali ALTAN | |
| Lsass.exe is not a virus Sawyer | |
| its either the sasser worm or its not the problem JoSe AnDrEs | |
| McAfee says nothing about this virus creating any file named lsass.exe. It does say that the virus causes the computer to reboot by crashing the lsass.exe process. Subsequent error messages mention this legitimate process as having failed. There is NO need to remove lsass.exe it is a vital system file in a networked computer. See also: Link Marshall | |
| has a key in registry wich allows ir to reload each time you conect to the net. use a virus removal tool in safe mode and you may get lucky See also: Link Kalhau | |
| I was infected by Sasser. This file is not reliable. Farid | |
| sabotages Messenger restart in 60seconds error Matt | |
| Error messages containing lsass.exe indicate Sasser-worm. lsass.exe is NOT part of the worm, it's save. Cruel Device | |
| As has been said, the worm exploits a bug in lsass.exe that causes it to crash. Lsass.exe is NOT the worm itself. If it were a worm, it certainly wouldn't be advertising itself by displaying a message with its own name in it. Troy | |
| This is not a virus, the Sasser worm attacks the lsass process and that is why your computer may shutdown, since the worm stops the lsass process from working Samantha | |
| Lsass.exe (lsass) and Isass.exe (isass) is not the same but looks like same...lsass is good, isass is the bad one gunni | |
| I was infected by this 30 minuteas after going on the net Bob | |
| The Windows File itself isn't dangerous, what everyone here is describing is a virus that fakes the windows filename - so lets not get paranoid about every lsass.exe we see... Martyn | |
| Just use Windows Explorer to check the date of the file against other files in c:\windows\System32. If you find lots of files with the same date it usually means it's a required Windows file. Another way to check files is to do a right-click on their name then select Properties and look at the various info listed there. Helvetica | |
| i have done research on this program and i think people are getting confused with sasser virus this lsass is a system program if you remove it your computer is left wide open for an attacker as lsass.exe is a security program to verify computers on your network so dont panic! hackman | |
| In the Windows/system32 folder it is a necessary file. Anywhere else and it's a virus! Caution, Blueyonder will tell you to search for sasser files and if you find lsass.exe to delete it - don't if it's the legit one! id1250 | |
| lsass.exe is part of the operating system with file extention .exe.hdmp or .exe.mdmp its part of the sasser worm virus. It looks like its gone when it has not. don't know how to remove it totaly as virus software dosen't. Jon Sasser victim | |
| A default startup process which controls log on security. The following link provides a list of default startup processes for W2K.. See also: Link Die Salomon | |
| If it is a System proces it isn't dangerous, But if the process is in your name it's a virus Myr | |
| Isass.exe and lsass.exe is allmost the same, they can be mixed up and are hard do repair VirusKiller | |
| harmless security file that can crash and cause shutdown, if this happens go into c:\windows\System32 and run lsass.exe to bring it back to life :) Smash | |
| lsass.exe doesn't control security, it's merely used by winlogon to authenticate users. Winlogon will then react on whether the user is properly authed or not. Die, Die Salomon | |
| PC shuts down the system with code 1073741819 | |
| causes the computer to reboot! John | |
| It causes your machine to reboot over and over Addy | |
| Authentication service located in various places, but should only run out of c:\winnt\system32. Other seemingly safe locations are C:\winnt$NtServicePackUninstall$, c:\winnt\$NtUninstall*, c:\winnt\ServicePackFiles\i386, or c:\winnt\system32\dllcache. BrianG | |
| Windows critical updates include this file. It is imperitive that you have the latest updates to be protected from viruses/worms/trojans Doug | |
| It's just the same name as the Sasser virus, but it is a f*cking Windows Process See also: Link Dj Project Ho | |
| This is due to the sasser virus (and variations) attacking the whole system 32. It will cause your computer to shutdown in approximately 62.5 seconds. In the code: the time to shut down - 62.5s is found. Whenever you access the internet certain sites (with http) activate it; then you have the allocated time to shutdown. Other variations include shutdown times of 30s and 124s. The worm is rapidly transmitted over a LAN and replicates instantly. However, the good news is: it is nothing that antivirus doesn't handle. DaV_serveR | |
| I have this on my computer and it's working fine. No problems with restarting or otherwise... Mike B. | |
| because not securty all files palani.s | |
| its reboot the ststems with in 1 min ramesh_2k12000 | |
| it will reboot my pc unexpectedly and randomly,without any special reason santiago | |
| Very annoying... Always reboots my computer before the system updates have a change to download! It's a totally new comp too, so I don't see how it could be a virus. xxx | |
| Sasser attacks this Windows process. lsass.exe is not a virus itself, it is shutdown by the worm. help | |
| I don`t know nothing , but I need help getting rid of it | |
| Sasser abuses it. Update Windows often to prevent problems. Kachiko | |
| When i seeee (YOUR COMPUTER WILL BE SHUTDOWN AFTER 60 SEC) simply go to ms dos and type "shutdown -a"........... Naseer | |
| It causes many unvolentary shutdowns, shame on MS? Jarmo | |
| Its just a normal OS file. If you have problems with your computer shutting you down saying there was an error with it...Then you should look into the sasser virus. Once you update to the windows xp service packet 2 you will have the lsass.exe file in two if not 3 folders. All three in windows one in the service packet folder one in the system32 folder and one on some computers is in a folder called SoftwareDistribution. If the file is in any or all of these directories it is fine. Solace | |
| Real windows file (unless tampered with). Love reading others lack of knowledge here on the subject.. Poindexter | |
| i know that i had service pack 2 for xp and when i removed it back to the previous service pack 1, it gave me lsass.exe and services.exe is missing and the screen goes blank viktor vasquez | |
| Seems to keep my hard drive busy Lloyd Plueschow | |
| This file compels the PC to reboot showing one minute alert message. Aatif Ijaz | |
| It reboots your system at any time jami | |
| i've deleted 6 of the same virus in last few hours called W32.HLLW.Gaobot.gen with filename lsass.exe so somethings up Travis | |
| This is not a harmful process Prashan | |
| it works depends and shut down the system at random Anup Deb | |
| Isass.exe (the virus version) will shut down your computer when you just made a connection to the internet for a couple of seconds/minutes. After that, it will give you a warning window, that the computer will shut down after __ seconds See also: Link Bastiaan | |
| there are 2 proceses: Lsass and Isass (in lowercase: lsass na isass). If you have the proces starting with i -- that's the worm. If you have proces starting with l -- that's windows file for logon :) | |
| Anyone who thinks this is "dangerous" has no idea what they're doing. This is a core security authentication file. Anyone who marked this dangerous is confusing it with "lsas.exe," the Sasser virus. A S | |
| Windows Operating System File, Service Authentication. If not in system32 folder, then it is a virus, otherwise completely harmless, and required to run the operating system. ph | |
| Symantec did not see anything weird. But it sure seems like it's taking up alot of processor power. Also svchost seems to be running quite high Charlie | |
| There is very important that you see in Windows Task Manager\processes is it lsass.exe or lsasss.exe !!! Lsasss.exe is Saser virus! zack | |
| It reboots your system at any time giving me 1 Min to close the application. I have no idea how to correct this problem Jana | |
| Legitimate XP file, is targeted by viruses, is NOT a worm/spyware. Infection of this file is due to negligance of user. Mat. M. (System Developer) | |
| It stop others from viewing your file over the LAN Marc Lesther | |
| Not a worm - Sasser has different filenames See also: Link Sue | |
| looks it locks and shutdown the pc euge | |
| its normal windows proces... ;-) | |
| threw away my computer See also: Link jim jacobs | |
| It cause shutdown See also: Link Babanelos Sakis | |
| Like many other Windows system processes, virii can take the name of this file, however, this file is also an essential file for the Windows OS. The Sasser Worm is the most common problem associated with it. The Sasser Worm attacks the file, and as a safety precaution, Windows shuts down so it can restart a fresh copy of the file. The problem is not normally with the file itself. Updating Windows will fix this problem. Xtra_Zero | |
| It's legit, but could get hijacked if not patched properly and no updated antivirus. Service packet 2 lololol! LouDaman | |
| This file has a lot of flaws which viruses target ie sasser virus. If attacked you will have problems that even windows updates won't clear. Your better off either going into safe mode to run your antivirus then or reformatting Al Hession | |
| The process by itself is not dangerous, but it is easily infected by virus sasser, who has harmful effects. Alberto M. Vernieri (Argentina) | |
| Something to do with windows authentication. When LSASS.exe is corrupted by Sasser or one of its variants, it causes Windows to reboot. From what I understand, anything that causes LSASS to operate improperly will cause the NT Authority Service to reboot the computer. You stop the reboot process by typing "shutdown -a" from a command prompt. Jason B. (illinois) | |
| system file Ciccero | |
| It causes system hangs and shut downs. if you are having problems opening regedit, try booting in safe mode and then going to the regedit icon and renaming it to : regedit.scr : This opens the file as a Screen saver and will open regedit. :) MunkY | |
| lsass.exe...i'm not sure if it is the cause of my .doc converted to .exe file as i save it in diskettes.... sonic | |
| Lsass.exe have the same name then the file in system32 directory. Open the internet, then an error box from Microsoft appear(send the prob. to Microsoft...) then click dont send. A timer is lauch at this moment and you have 1 minute to find something. 1 solution is to fdisk /mbr because if you try to format c:, the worm still on your hard drive. Not dangerous but very bored! Bob | |
| The lsass.exe file is needed for logon authentication and is needed especially in a client/server environment. The sasser virus is a completely different thing, if your computer begins a countdown to shutdown when you open a web browser or when you start up messenger, then you are infected by the sasser worm. Get cleaned up by running AVG free from www.grisoft.com Timmy McTimmunce | |
| LSASS.EXE is necessary for the XP OS. Symantec has a removal tool for all variants of Sasser which I would recommend you run. Before you run the tool, ensure that you have disabled System Restore. Clean the infection (if any) and update your OS by installing or re-installing the latest service pack and critical updates SuperMe | |
| lsass.exe is part of windows OS. If you delete it, or confuse this with a virus, you are retarded and shouldn't be using computers. Check the spelling and it's location people!!!!! not you | |
| Legitimate part of WinXP that sasser worm can exploit. MS site has free check to confirm whether your file is OK or not. See also: Link Steve M. | |
| Its an .exe file but doesnot harm . It irritates a lot due to abrupt message for shutdown within 60 secs. Rohit | |
| if lsass.exe can provide a shutdown im not so sure. but if than try it with shutdown -a .. only on XP, and not other admin | |
| Lsass is a normal windows system process, but it is part of a very large security hole in windows. You have to download the patch from microsoft to fix it. You can disable the shutdown by running services,msc from the run option in start menu, selecting Remote procedure call, and selecting the recovery tab, and setting all of the boxes to "restart service". Preacher | |
| It makes the computer not able to get to Win (normal & safe mode). Repair or format needed. Michael | |
| It causes shutdown, spreads in the network and generates a huge traffic. See also: Link Amit Ganguly | |
| it reboots ur computer and disables the internet / network Jens | |
| it works depends and shut down the system at random Mathias Trolle Nielsen | |
| needs windows operating systems .causes frequent shut downs but hardly any loss of data porque | |
| That it keep shutting down the Windows Station... YK93 | |
| It also causes my PC to reboot over and over - Windows never starts up Frank | |
| I found both lsass.exe and lsass.dll in my PC. My PC was shut down in 1 mins after I connected to broadband. It displays "lsass.exe terminated unexpectfully with status code 128. System shutting down in ...". Found "W32.Spybot.Worm" and some other Adwares in my PC. The worm also exists in "system32\crss.exe and spoolscv.exe".Symantec gives suggestions to remove the virus Ben | |
| "lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. Voskuh | |
| Use KB835732 patch from Microsoft, depending on OS version, find stinger.exe (McAfee) to kill sasser Johan Does | |
| A not harmful process , don't missmatch with lsasss.exe releated about sasser. Édgar | |
| It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token. Arun C (Amrita) | |
| Keeps shutting down computer while on the net. I removed it from windows/system directory and it fixed the problem. shane | |
| just purchased new computer with Win XP.What is written here explains my problem. Never come across this before in older Windows. Obviously a case of looking into the cures posted. Thanks to those of you who bothered. Chas | |
| I found it after I disabled xp`s firwall and alg.exe dissapeared dave | |
| seems to be both a system process and a virus Gordon | |
| This file appears to shut down your computer as soon as you try to run the windows update. Is there another way of running the update without going online irwinhkp | |
| Please help me email to [email protected] as lsass is in my C:\windows\fonts\lsass.exe and when removed sucks my system James | |
| It kills the internet access and lan security Andriyana Tresnawan | |
| the file takes care of your passwords etc... Mike | |
| The virus forces my system to reboot given 30 seconds within which i'm to save my work, Ibro | |
| if it gives shutdawn window, do this... goto start and run and type "shutdawn -a" and u will be happy | |
| IT'S NOT DANGEROUS!!! system file WHAT?!?!?! | |
| its a windows file the pimpChimP | |
| So far know one has given a solution to this problem. | |
| This is NOT harmful. Sheesh people - learn a little about your computer before you post a message saying this is a virus! Dean | |
| This file name is the title to a window which states "When trying to update a password, this return status indicates that the value provided as the current password is not correct". And about a second afterwards, system reboots without a chance to go into my desktop even to run the shutdown -a command which I've read stops the constant reboot :( So not sure how to get out of this one. And my CD drive is not recognizing any CD, so I can't run a QuickRestore program to put system back to original settings. Any suggestions, I would greatly appreciate it. fernandez | |
| Sasser affects this system file, when no infection is not dangerous Reo | |
| seems like the virus was named after the process to make people wory when they explore the running processes ;-) | |
| Not a Worm just a leech-This File will hang your PC when booting very annoying Herbert Matthews | |
| shuts down computer everytime you are connected to the internet doesnt seem to affect my computer thought when i have windows xp firwall on. To activate the windows XP firewall click on control panel, network and internet connections, My network places(in top left hand corner), view my network places(top left hand corner) then right click on my local area connection, click properties, click advanced and click the little box so a tick will appear in it to enable it. Turn off your modem before you start up your computer to give you time without the shutdown box popping up and shutting you down! Matt | |
| An OS file in Windows XP. Used to authorise logons. Local Sever Security Authorisation Service. For those worried about the virus, simply do not connect to the internet without installing a firewall before establishing a connection! Those who threw away their PC's are a bit silly. Fixes for the sasser viruses can be d/loaded from another pc. Paul | |
| THIS IS A COBRA FOR ANY COMPUTER JHAKKAS | |
| lsass.exe is not a virus. It is a working program of WinXP. My school's network manager even had trouble understanding this and the network security kept calling me to tell me I had a virus. Good lord the incompetence is abundant. NOT SASSER VIRUS | |
| Sucks..I can't get into safe mode, My computer starting shutting down..Now It won't even boot up into windows..Keeps saying lsass.exe error found.. I don't know how to fix it..It keeps shutting down all my virus programs I scan with too..HELP CherryKissies | |
| it is a virus (worm) generated from source code of sasser. i think it is a real danger because i've got it and he produced me some damages...crashed hdd,can`t open my optical drives...that`s all Stan Mircea | |
| firewall caught it trying to talk to s207-81-158-224.bc.hsia.telus.net, I would say it can be misused somehow Al Schemmer | |
| This file is not a virus. If you have any third party appllications or vb programs which calls the windows api's and if the function fails then their will be lsass.exe error adil akthar | |
| when i am in the LAN after a few seconds on my screen apear that error ho said that my pc is shuting down in 60 sec. i don't have this problem when i am connected to the internet. i have the windows 2000 pro operating system and i don't know haw to get reed of this error sergiulic | |
| lsass is a vital system file which can be afected by sasser virus and it causes system shutdown in 60 sec. omjaiswal | |
| Lsass.exe is not a virus benjamin | |
| It shuts down my computer so I changed a setting on my computer and now there is no sign of error now but I am wondering if it will harm my hard drive as it is 1 day old Michelle | |
| I am updating my xp EVERY DAY and just yesturday I tried to start my laptop and at log on, it gives me a lsass.exe-system error message saying that An invalid parameter was passed to a service or function. I update my computer every day and have all the service packs installed. lsasser? | |
| lsass = local security authority subsystem serviece Kematian | |
| 1 step : LSASS:exe is windows proces and u cant work without it and it isnt virus. 2 step but LSASS:exe can be harmed by virus which is taking some part off your internet conection and bombing some who knows where ip, Many hackers send virus which atack yours LSASS.exe and when LASASS.exe is atcked he is no longer your old windows pal he becomes bad and starts riping your conection all wot u can do is format and upgrade only windows to the last Griffit | |
| A fake lsass.exe got into my pc and causes a shutdown after internet communication. It appears as though the lsass service just crashes. Put xp sp2 on my PC and no problems since. Ellwood | |
| Getting on web, about 1 minute later, a system message appears, the pc will shut down in 60 seconds. Additionally the message requests to close all running programms, as active files could be lost. After 60 seconds windows xp crashs. No chance to work on web. alex k. | |
| I don't know what it is but it is taking up half my cpu usage for no reason Hercle | |
| it reboots ur computer and disables the internet / network rahul | |
| Due to this system will shut down within 60 seconds Murty | |
| Critical process for user authentication and logging Read article on Microsoft official site Maham | |
| People who have nagative comments such as "causes computer to shut down at random".. you have another problem. I would suggest trying a better virus program and firewall. This file is required by Windows and works just fine. John | |
| it become dangerous only when it is not in safe hands, since this file is associated with the windows logon authentiction, so if some one gets control over this file its easy for a hacker to get into your system and he can run any script batch file with out knowing you and this is why we several times see that system behaves randomly as if some one is shuting down or closing applications. Hadi | |
| I only know that LSASS.EXE (not ISASS) will be blocked by Virusscan Enterprice 8.0.0 (McAfee) because its a standard blocking role. Its not clear to me why. McAfee seems to think that its a risk file?! Yvo | |
| it shuts down the system in 60 seconds Sad | |
| Shuts down the system at anytime. Mustafa Zulqarni | |
| lsass.exe systemshell, not a virus. capslock | |
| it just restart my pc again and again faiz the great | |
| Use protection, then you will avoid diseases! SivertDaHaX | |
| it works depends and shut down the system at random noman | |
| it knocked out my other computer, and i can't get back in frank cracolice | |
| Nothing except it can cause an error that will reboot the server Jonathan | |
| Hijacks MSN and attempts to spread itself while disrupting Browser and other processes The Illusionist | |
| Isass is nothing but it's a type of sassar virus who can easily removed by any blaster antivirus. rahul soni | |
| Not much, but when the 60 sec thing comes up, go to run and enter shutdown -a. This will by you some time Matthew Smith smitty86ca | |
| vital security process, patch your system and keep your system clean and you won't have the 60 second shutdown timer! Firon | |
| LSASS.EXE does not seem to be a worm but part of network authentification process; check system32 directory it must be in there Andres | |
| when i enter into the net it automatically shut down with status code1073741819. so i am not in a position to use net. and i do not know how to rectify this. mani | |
| This filename is used by some virus (in a different location though) and will be used to execute code. In my case it executed an Iroffer app (IRC XDCC Deamon). Just check the location of the file. If it's not "C:\Windows\System32\lsass.exe" then you should be alarmed! DutchKid | |
| i have reformated my computer 4 times and still have the same problem Jesse | |
| The virus file (lsass.exe) has been cunningly and brilliantly disguised as the system file (lsass.exe). The name of the virus file begins with an upper case or capital "I" (EYE), whereas the name of the system file (lsass.exe) begins with a lower case or small "L" (EL). To an untrained eye, the difference between is visible only if the system font is changed. For more info, check at http://www.softwarepatch.com/tips/isass.html See also: Link Major Geek | |
| as it is found in the operatining system and also in windows updates it does not seem to be a virus file size is 13 312 byte should be fine SaTeR | |
| Reboots the system at anytime (random) is a the slowing down of the pc is the virus part but the reboot message which u cant cancel is a spyware HHH | |
| if it fails, it makes system crash flyed | |
| It has to do something with the Security settings for the windows vishwas | |
| My computer would not load up to start.. Windows system error file name no found. Had to do a complete recovery with recovery disk and lost all my personal information. Don | |
| lsaas.exe has come up within a virus check and for all everyone keeps mentioned sasser virus this has identified troj_delf.db as the virus. Tracey | |
| system shutdowning | |
| sure wish someone would just say it in lay man's terms how to get rid of these 'timeout' and computer freezes. DJA | |
| This file is just for the graphical interface. Jasper Wammes | |
| its not so dangereous. Hit the internet connection properties and enhance the firewall if you use XP. And the problem is over.. Ayhan | |
| This will shutdown the system with error messege system32/lsass.exe,so u need to go to cmd and give cammand as shutdown -a then it wil stop the system shut down so u can download the security taskmanager and run so that it wil recover this error ranjith | |
| Windows System file...when u`ll see again that shutdown message just go to Start- Run and type shutdown -a Puffi | |
| its just puts unwanted files in your local disk jimmylfc | |
| it shutdowns IDE of Microsoft Visual InterDev | |
| It's a system file using for logon process Dinesh Sanas | |
| "C:\WINDOWS\System32\lsass.exe" is not a virus/worm/adware/spyware. "lsasss.exe" with the extra "s" in any location is dangerous and should be deleted as it is related to the Sasser/My Doom worm. Preston Mathis - Certified Computer Engineer | |
| there is a lsass.exe error,LSA Shell Hettiarachchi | |
| PC is in a constant reboot cycle - LSASS.EXE - system error "When trying to update a password, this return status indicates that the value provided as the current password is not correct" and then reboots. Cannot F8 into any startup mode without getting this error - safe mode, command prompt, ect. Pastor Don | |
| It just shut down my system after showing me acountdown for i min. flat. V.annoying prashant | |
| It is an essential Windows Process, if it encounters an error or is terminated your system WILL shutdown after 60 seconds and I know of no way to stop that from happening. There are malicious processes under the same name, sometimes you can tell if they're fake if they're under a user name other than SYSTEM. Some viruses also infect this file, but it IS an important Windows component, so don't "fix" it by attempting to delete it. Update Windows to prevent it from getting infected, there also may be an update that fixes the infection. Anti-virus programs should now fix problems caused by Sasser Maccam94 | |
| OS file in Windows XP/2000 as long it is localized in /system32... If not, probably a worm or worse: Sasser! The problem (for the OS file) is to let him outbound to internet or not... Kusanagi | |
| I blocked it in Zone Alarm (access & Server)...no difference Richard | |
| WTF people, it's killing your machines and you don't even know it!! prophet | |
| legit system file but vulnerable to attack - so use firewall jumbaya | |
| when connected to net it shows timer of 30 seconds and shuts down See also: Link Vishal | |
| this will shutdown my pc without asking to me. Nitesh | |
| this shuts the computer at random and I have to reboot manually. 4 months I have it moulaf | |
| This has been affecting my PC lately by subsequent shutdowns. As soon as I try to connect to the ineternet shutdown takes place after a warning message within 1:00 min Udaya | |
| lsass.exe is harmless, its been said hundreds of times, Its a system process for handling user logins, if u think its a virus or some other danger to your PC, end the process, but you will need to reboot after you do because it will crash the system. And you cant say Isass is suceptable to viruses because every file no just system files are prone to virus attacks, so get over it. Its harmless Si UK | |
| it disable MSN messenger & make system busy black | |
| is a spyware Rick | |
| Interesting it seems to be infecting dvrs and is pair with a mpr file John | |
| I had what appeared to be the Sasser Worm, but my system checked out clean. Norton, McAfee, et.al. all gave my system a clean bill of health. After a week and a half, of everything from doing a system restore to an earlier date to doing a Windows repair, I found that my local c:\windows\system32\drivers\etc\hosts file was very obsolete. There is no good reason to have something other than the default (localhost definition) when on a network. Restoring the file to factory values, cleared up my lsass.exe, userinit.exe, and svchost.exe abort issues as I connected to the correct network servers. Lou | |
| if u need time to work on your computer before it shuts down go into the date setting and put it a couple of days back. this will give u time to work on it AB | |
| It affect logon G Patterson | |
| It's really dangerous when is infected 101 | |
| random shut down. this should be either updated or deleted using a virus scan or an advanced spyware scan. it will completely destroy your operating system. so bad that it will not bring up your desktop or any application you may want to run. KRYSIS | |
| It won't allow me to access my system. I have an active Norton 05 running on my system. X | |
| At random encounters (about at least once in 20 minutes, but mostly every 5 minutes) it keeps my system BUSY by drawing 80% CPU load on a PIII-866 running XP PRO. That makes me angry, because that interrupts file transfer for 1-3 minutes (CPU can`t handle I/O's in that time). Sometimes i can set task priority to LOW (that helps), but most times i get an "access denied". I think, this is still part of the XP OS! Schnitzelfisch | |
| it is a virus | |
| Extremely dangerous. Delete it and all other files in C:\Windows\system32\ or else your computer will spread viruses everywhere. | |
| ive reformatted my computer several times and this virus keeps popping up. as soon as i get my machine booted into windows this thing trys shutting down my computer and een after i remove the thing with a patch it keeps me from installing new software and all kinds of crazy crap. if someone knows where i can find out why this is happening on my machine please post it. kirk | |
| I feel it is a file which affect RPC and shut down the system randomly Trimay Prasad Aryamishra | |
| i seems that when it krashes and tries to restart that it also removes documents folder in my computer and name in start menu. Andy | |
| It starts rebooting immediately when I get connected to LAN, but it's not lsass.exe fault, the worm it self causes the close down Wild Finn | |
| This filename is used by some virus (in a different location though) and will be used to execute code,windows\system32\lsass.exe terminated unexpectedly with status code 1073741819, system will be restart with in 60 second K.DHARMALINGAM | |
| It's not a virus! It's essencial for nt platforms... splash_ | |
| LSASS.EXE or lsass.exe (Local Security Assistant is system file located in C:\Windows\Sytstem32, whereas ISASS.exe or isass.exe is the virus file | |
| Deutsch: Also, der Prozess lsass.exe ist in Ordnung, allerdings muss man drauf achten, dass es nicht Isass (mit großem "I" am Anfang) also Sasser ist. Wenn der PC herunterfahren will, einfach auf Start, dann auf "Ausführen" gehen und dort folgendes eingeben: Shutdown -a English: The process called "lsass" is OK, but you have to check, if the process is not "Isass" (with a big "i"), because this would be "Sasser". If the PC restarts, go to the Start-Menu, then start a new Process with the following text: shutdown -a NeoXC | |
| This is NOT a virus. Lsass.exe, a perfectly legit running process not doing any harm. isass.exe, takes advantage of a security vunerability and causes Lsass to shut down your pc. Like others have said, just type "shutdown -a" in run to stop the virus shutting down your pc. Bladerunner229 | |
| windows process, no dangerous | |
| I found that by using 'Stinger' the prob was fixed. I had the Korgo.worm and its that which uses flaws in lsass.exe and RPC to shutdown your machine. To terminate the shutdown, go to RUN and type CMD or Command. then type Shutdown-a. See also: Link ..:: AvIzOnE™ ::.. | |
| OK - I have been experiencing problems for a couple of weeks. Have built up another computer with same spec's as faulty one and put on same network. When firewall reconfigured to send port 80 stuff to new machine, new machine started shurring down with isass.exe code 128 errors. The older computer which was previously shutting down now works fine. !!! Have noted that immediatly before shutdown packets are received from the net. Could there be some form of Hack that is creating this problem. DougCooke | |
| It is confirmed that the lsass.exe file is infected with a worm, probably a Sasser. The lsass.exe is a System process file, but you cannot expect a system file to notify you that the system will shutdown in 60 seconds, its ridiculous. I have run one of the Symantec fix tool, but the issue persists. However, there are other variants also, but i couldnt try those. When you receive this alert, type Shutdown -A at the Run box from Start menu. This should help you. Bimal K.P.G | |
| Said lsass.exe was missing, then asked for password.. problem is there was never a password to begin with. 2nd time with this problem. First time we did a clean install, same with second. Should I expect this to happen again, and is there anything I can do to permenently lose this problem. I have a current anti-virus and xp firewall. I connect to the internet through a wirless router. How did i get this and is it the sasser worm? N8 Ting | |
| What i dont understand is everyone wants to argue, its a virus, its a system file, but the fact remains, i still get the error on boot and how do i correct it. if you dont know, why post your comment unless asking for help. i am looking for info like, restore from the repair option off the system disk or copy the file from another computer to the system32 directory, anything but mindless talk with no solution. rude1 | |
| lsass.exe is apparently modified by a Trojan Horse named TROJ_HOLAX.C. This seems to be a new Trojan which is not known either with microsoft oder any of the common Antivirus Programs. In my case it was quarantined via TrendMicro but, anyway it affected most of our servers. The lsass.exe is shutting down my systems, I didn't find a solution yet. I would be grateful for any information Chris | |
| turned up in an error msg when installing XP. System seems to have hung on installation after viewing this error. "The application or DLL C:\WINDOWS\system32\SAMLIB.dll is not a valid windows image. Please check this against your installation diskette" Mickey | |
| at the end no one answered the damn question. of this stinking lsass.exe, I have the same thing happening to computer ever at starting to boot with a disk, it tells me that there was an invalid parameter was passed to a service or function ME | |
| This file is created due to infected by virus.The system warbns you you to savethe files and it will be shutting down in next 60 seconds.Though bnot dangerous it makes me feel irritate when i am in mid of some important work. mukesh agarwal | |
| When i try to get back to windows it comes up with system error Lsass.exe and below it, it says "insufficient resources to start API" how the hell do i gt rid of this so i can get back on my computer? NEO | |
| When i try to get back to windows it comes up with system error Lsass.exe and below it, it says "insufficient resources to start API" how the hell do i gt rid of this so i can get back on my computer? NEO | |
| if your computer begind to shutdown go to run then cmd and type in shutdown -a and it will stop it but only do this while you are virus scanning or it could leave the virus on your pc BIG G | |
| my current problem is, that my computer wont even restart. It only shows a black screen after rebooting and tells me that "isass" couldnt been reinstalled..is that the worm too?:( Sevel | |
| I am facing lsass.exe problem from last 2 month if and one know how i can resolve from lsass.exe problem please tell me at [email protected] mack | |
| Very difficult to remove, because is part of WIn2K system =S. That's why, use Linux, Solaris, MACOSX, uff, everything but not windows..... josue | |
| This is really crap. it just reboots ur computer when u go to the internet and my symantec cant remove it and not even my virus scanner!!! IG | |
| My lsass.exe is not a virus (I have sp2 and Norton), but the problem is that it works continously, accessing the disk. How can I stop it? Jacob | |
| Just having the same difficulties that everyone else is on here... its "unexpectedly terminating", and shutting the comp down God Cheese` | |
| This FIlename is used by some virus & due to this the system shutdown rapidly and also no network path is found Gunjan Pandey | |
| Not a good file to have, but dose host a home for viruses occasionally, quarintine and see if you can remove. See also: Link Aaron5367 | |
| it shutdowns my windows and restarts thus creating a great problme when i was in a important work Kiran | |
| Have a question--lsass.exe is in my c:\i386 and in servicepack and in system32...safe or unsafe? tex | |
| jiganamah virus ieu mah, soalna komputer win2000 server urang restart wae, keuheul pisan. Indra Sukmayana | |
| it shuts down system randomly and destroys exe files of othe applications Afolabi | |
| System restarts frequently and does'nt creates the network connections Gunjan Pandey | |
| lsass.exe is apparently modified by a Trojan Horse named TROJ_HOLAX.C Chris | |
| if it is anywhere other than windows /system32 remove it BG69 | |
| Help me! its completely destroyed my computer! BEWARE!!! Isass is evil... | |
| if your computer begind to shutdown go to run then c | |
| computer go pzffffff when it turn off See also: Link | |
| it doesnt make the computer to boot See also: Link Lokesh | |
| I think it's on my computer... SARSSER | |
| lsass.exe is not a virus Jacob | |
| Einfach mal googln'... noname | |
| there are TWO files that look the same Lsass and Isass. Lsass is the Windows exe and sits in the C/Windows/System32 folder, and isass oftern goes to the SYSTEM folder; C/Windows/System. Use View/Details to place files in an alphabetical order and ONLY remove the isass (Because of default fonts you must list the files alphabetically. To remove usea programme like Gipin Softwares Move on Boot which will remove ANY file that will not delete. Mostly you do not need to reboot. Once you have selected delete on next boot the file can then be right-click / deleted immediately See also: Link JMR | |
| There is also another file named "lssas.exe" Pay close attention to the spelling of filename......anyway i go into taskman and end all process that i don't want anyway......this is one of them. sometimes runs multiple instances at the same time as well so make sure you "End Process Tree" for both if they appear......I HAVE NEVER HAD A PROBLEM LEAVING IT OPN SYSTEM AS LONG AS I END IT AFTER STARTUP!!!!! Also run task "msconfig" and you can choose not to have it start with windows :) Roger | |
| Put in a firewall to get most of the problems fixed. Or use the Windows Firewall, it is present in pre-SP2 also, it is named differently. Use Stinger from the McAfee site. Then use Ad-aware and spybot, it solves other issues also(If your system is affected by this old a virus, it will be affected by spyware also. To get the run command without using the start button, use the combination of the Windows key and 'R' together. Then you can use 'shutdown -a' to abort the shutdown. See also: Link Brainiac | |
| I know that this file is properly referred to as Lsass (and I know better than to refer to it as lsass.exe w/ alower case L). And I know that isass.exe is a malware file which is NEVER to be referred to with an Upper Case "I" (i), which is indistinguishable from the lower case l. (L). If all who wrote about these files consiistently used Lsass for the Microsoft file, and isass for the malware file, much pain and confusion would be avoided. | |
| Very dangerous virus no matter what anyone says. It is both a Windows process and a virus so it can be misleading. It has wrecked one of my computers and has forced me to format another. If you ever get this virus, your best bet is to make a parallel copy of Windows (if at all possible), then copy impotant files onto disk. Afterwards, format your machine entirely. It has come back twice for me and it's a load of trouble. A Person | |
| i am using windows 2003 server and having problem with lsass.exe and shution down the server within 6x seconds then i have set the permission this file to deny to admin then i restart the system but system could not restart it is hp server ML 150. how can i get it back my system any clue? plese help me to [email protected] allemirra | |
| this is the vuln that the sasser 445 and 139 attacks. also this image name is commonly used in many rootkits and backdoor servers. just have a good av and firewall installed and you should be fine although having said that i have got past norton security recently with this vuln with rBot. So be carefull. :-) Ownsya | |
| there is a difference between Lsass.exe and Isass.exe. well its actually 'lsass.exe' and 'Isass.exe'. but while the first one is typed with a lowercase L, the 2nd is with an uppercase i. which looks the same. the L one is safe. don't delete it. alfred | |
| It is a virus or trojan or whatever it is, it must be annoying! No, doubt! I got my Windows shuting down in countdown of a few seconds, while I was starting connected to the internet. May Al-Karim always protects me from such disassters!!! kuki_furuya | |
| This file seems to be hogging all CPU, when I go into task manager it is using 90+%, So IE slows to a crawl, anyone have any ideas? I installed XP only about two weeks ago and it worked fine for the first week Thanx Josh | |
| Thank you ..:: AvIzOnE™ ::.. Though I've thought this may be related to the PRC thing, I didn't think that they're directly related. My problem is that whenever I start MSN it will terminate wityh status code 128. See also: Link | |
| don't confuse a lower case L with an upper case i when looking at the file names as one file is a virus and the other is a windows os file for security. this is a clever trick to hide the true file name Halgasm | |
| It disrupts my cool computing by shutting down at random. I found it 's a worm that attacked one of the computers on my network. After dealin with it it has not come back worlay | |
| Well if it is not running from the System32 then it is the sasser worm, as long as its running from System32 it is harmless, all it does its validate Windows User Logons Tim | |
| Your machine does not need to be infected for you to receive a shutdown message from lsass. Its a sign that a remote process is doing an attack against your PC. See also: Link Tommo | |
| it is actually a system file used by the Windows System being exploited by Sasser , a variant of Plexus, that restarts the PC every few minutes. Edsel | |
| virus is having the same name as this file.. that is confusing and dangerous for the users. may be virus using this service too Gaurav Julka | |
| it shut downs my pc by giving waring before 60 seconds automatically.how should i overcome this problem, can any one suggest me lokesh | |
| I have just got the virus it just shuts down my pc after a minute countdown and gives lsass.exe errorcode 128 Moagi | |
| It shuts down my computer with a 60 second warning. Download of direct x failed at 99%(dial up) Macintosh | |
| I think this is a virus, it's slow down the PC and call RPC to shutdown the PC in one minute. Chandra | |
| i think it is about system secrutiy on ethernet card, or other card's configration error. cüneyt uğur | |
| used for user authentication, but i automatically shutdown the system at random mathanraj | |
| this file is very crictical it just shuts down your computer very quickly dia | |
| use RUN command and type shutdown -a to stop RPC block ports 135, 445 Death by sin | |
| OK! I understand it's not the virus, but how do I get rid of it?!?! chad | |
| causes system to freeze, roboot over & over. c/c roms will not read | |
| it shuts my computer down within 60 sec. :( i hate windows :D KruG3R | |
| i cant find it in any folder or system32 folder or anything.. bob heinbokel | |
| everytime i start my ie, my computer shut down in 55 sec. anti-lsass | |
| Isass.exe is a worm, and Lsass.exe is Windows native Joe Zhao | |
| randomly gives me an error and restarts my computer stephen | |
| This isn't a virus, is worse, is a windows file!!! Rogelio | |
| it is from Microsoft. It keeps reading and writing Ning Cao | |
| I believe this file would be a window process Private Ryan | |
| I have bee facing same problem a you See also: Link Paul Martin | |
| its is very danhgeroiusprasjesh | |
| cause shut down in 60 secs rr | |
| it is not a harmfull file Ahmed Mamdouh | |
| Not a VIRUS Joe | |
| i am infected with this worm sasservictime | |
| it is a bad one... it lurks within your network... tip: when your frustrated... before reformating a networked pc... kindly pull off the lan cable first.. to keep it inside and keep others out. JC | |
| Repair for error that stops you from booting from this system - not virus program is knowledgebase 307545 at microsoft See also: Link Ron | |
| Isass.exe is an upper case i. lsass.exe is a lower case L. Virtually indistinguishable huh. More and more harmfull stuff is being sent out with window file names, using1instead of l, I instead of l etc..... i would advise you all to set your default font to sans serif or any font which distinguishs between letters. isass.exe is a trojan loader, very very bad, Lsass.exe is the usedr authentication process, harmless but isass.exe crap Lsass.exe so eventually it fails to reconise internal passwords and prevents your OS from starting. I've just thrown my laptop out of a 6th story window. Mekatrig | |
| this virus is so dangerouse and make me to waste my time seraching it's solution muse | |
| it keep rebooting my system after some fiew minutes. this happens when i connect to net. i have just reformatted my PC but still having the same problem Buto Man | |
| For 2 weeks i try to fix it. i formated my PC for many times. isass.exe don`t let you to use a firewall or a antivirus. I don`t known what to do :( Ionutz | |
| shutdowns my windows and restarts . I'm very engry. I have Bitdefender, I have a good firewall, a good Spy, and it continues to restart my computer. Foga | |
| Everywhere Claims It To Be A Windows App, But When I Didnt Block It From The Net, None Of My Internet Required Applications Worked. UnEmploymentDude | |
| it a very troubling exe as it frequently reboots the computer girija | |
| It is a SYSTEM file, which is absolutely not harmfull it self. however multiple virusses abuse functionality of it, or render this program instable. This has caused a lot of fals alarms! | |
| my computer cant boot!!it keep on saying missing lsass.exe!! law | |
| lsass.exe is not a worm or any virus it's a os program file but sometimes it can deactivate from services rpc pawan srivastava | |
| It's a system file. What are you going to do; delete it? Lsasss.exe (the virus) has an extra s on the end LEAVE IT ALONE | |
| Download stinger programm to remove the virus See also: Link Smeik | |
| It's a security update for outlook and windows I'm not a prmotor for norton but if you have good security set up programs like trojan guard, zone alert or norton you will not be infected by sasser or any other virus Alucard | |
| When the system prompts shutdown, go to the right hand corner and modify the date by one year. the message will then show you that your computer will shut down in 365 days. now you have a lot of time at your disposal to think about the problem. Arun | |
| lsass.exe is not a viru. However, it may have a Trojan virus attached to it. W32.SPYBOT.WORM CAN ATTACH TO IT. Norton and Sophos will not remove it directly. Reboot into safe mode scan c:\windows\lsass.exe if trojan still there Norton should then remove it. Tony | |
| Read the note! c:\windows\System32\lsass.exe is not a virus. Other verisons of lsass.exe (different directory, different capitalization on the file name) probably are. We are talking about the windows process in this web page, not the virus! Kat | |
| I recently had an encounter with this lsass.exe with my WinXp. Then after 60secs, it will reboot my Pc. I did a reinstall of the OS. What takes place now is that when the shutdown process as initiated by NT AUTHORITY\SYSTEM occurs, my Pcs dont reboot at the expiration on the counter but all other drives like the floppy, cd will cease to work until I now I shut down and restart the PC. emmanuel | |
| This file is not the problem, the problem is a worm that has infected your computer. I did what I was told to at the site that I have linked and my system is functioning normally again. Good luck. See also: Link Matto | |
| Lsass.exe is a file which starts a process responsible for generating an authentication token. Its not a virus. A virus ( idont know its name) hinders the token , and authentication fails. Therefore a restart is initiated by Lsass process. See also: Link Ankit Saxena | |
| I Solved it to install sp1 and i guess this reason is about some trojen or virus come from internet when i look crack :) Cüneyt UĞUR | |
| r u tired of all these advices... i was ;) erni | |
| The file lsass.exe in windows\systems32\ is infected because this the windows service and the anti virus products is update little so that most people have one kind of virus hyde | |
| If your computer keeps rebooting due to lssass then go to the symantec website and download the sasser worm removal tool. It worked for me. Dinger | |
| When I had norton I didnt know that this file existed, I uninstalled Norton & installed Avast and since then Avast has been blocking it. Charmaine | |
| Honestly people, it aint a virus, Do some research on computer files and find out for yourself. Do not believe what you read on here, some are true some are not. If you get a message reading you computer will shut down in 60 seconds. download the tool to get rid of it. GOD | |
| -it roboot my com without notice if im playing games... vbnmgjk | |
| as fromt the top of the page here :-- lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token for them that says it a viruse are scare mungering, yes if it fails ur pc will shut down, See also: Link Shalianahe | |
| Vital for windows. Very rarely causes a lot of disk activity , but I think it's nornal. | |
| It is a windows system file. It random shuts down the PC which causes loss of valuable data. Bother the users. Destroy CDs/DVDs in Burning situation. Needs immediate solution for all OS. Zafar Alam, SMWT | |
| I hv experienced first time, it is very dangrous when u hv to save many files, a lot of data can be damaged. Aamir | |
| Lsass.exe ís obviously a windows process. But the vulnerability of it makes it dangerous. isass causes annoying problems, like not even being able to start windows. How can I fix it when I can't get windows to start (not with a system restore or in safemode)? | |
| thank god. not a key logger Gerard Way | |
| it randomly rejects memory and shuts down computer. Lisa | |
| it force system to shutdown Ozan Dogan | |
| some time virus like this (or not) shutdown my computer automatically devotee | |
| Legit file / process however, if it's been infected or replaced, even a new installation impossible as you cannot even generate a working OS Shell to login to. Apply the necessary security updates and protect the file from infection / replacement. I have a copy of Win2K Pro and the install copy has an infected lsass.exe file so you can't even install it period. Scooter | |
| Hi, i started having this problem awhile ago but never go the message.... it just kept restarting as sonn as windows loaded.... i tried a fresh install and i cant finish it as it keeps giving this message... what can i do :( any help is really appreciated alien13 | |
| System security logon Jordan | |
| This problem is about trojen you can solves it install sp1 for 2003. and you can use this command on run "shutdown -a" to prevent shutdown Cüneyt Uğur | |
| If broadband cable is connected then only this "Lsass.exe error windows shutting down in 60 sec" error is coming since DNS server trying to login our PC for verification and our machine is verifying login user this conflict is happening. Still I am searching solution for this. Ramesh N | |
| its a critical windows file but some time infucted with trojan. you have to turn of the system restore for root disk partation and then restart the PC and during the restarting keep press the F8 and chose the " safe mode" and then run your antivirus scanner and also microsoft anti spyware to clean infacted files. Salim | |
| well this file or .exe is not so dangerous as it is considered, before coming to a conclusion we have cheke whether the lsass.exe is runing or not that local security authhentication server,after that chk it tin the c::/windows or c"/winnt. sanjeev | |
| The lsass.exe is a genuine part of the Windows XP operating system. It is neither a virus nor is it harmful. That doesn't say that someone either has or hasn't figured out how to misuse, or potentially abuse it. Most criminal hackers will do anything to harm or damage a users computer. But, the basic files and programs that come included with MS Windows are harmless. See also: Link netaces2k | |
| I only know what I've read here. Not much inf. Ken | |
| It forces a shut down on your system when connected to any intra-network Ape | |
| it is a file required for networking purpose in win 2000 and xp but is sometimes overwritten by worms n trojans in the same name lsas.exe located in c:\windows\system32 which then affects system's performancemakin it unstable. When the file is overwritten by worms for example BLASTER it fcontinuously fres error regarding REMOTE PROCEDURE CONTROLLER and makes stystem to shutdown in 60 seconds. do contact me for further queries pratham4u2002 | |
| forma part del sistema macbord | |
| some virus got attacked.so my system gets shutdown in 60 seconds some times. ujwal | |
| thaught it was virus but is something to do with logins harrister101 | |
| cause shut down in 60 secs chandan | |
| *sigh* People, it is NOT dangerous. It is a system file. Try disabling it in Task Manager and just see what happens. The Sasser worm has a different filename. The shutdown is probably a corrupt registry key. See also: Link Kisara | |
| The lsass.exe fille which is mentioned here is an important windows file. As long as said file is located in c:\windows\System32\lsass.exe it's the real file. The lsass.exe which shuts down users PCs is the W32.Sasser Worm. To prevent this problem, download and install the KB835732 patch from the microsoft security bulletin MS04-011 page, & enable the firewall in your network connections. See also: Link Mechpaladin (Vernon Chan) | |
| If this file is corrupt our AD is corrupt .Imagine your are working on server and all of sudden you have error"your server will rebot in 5..4..3..2..1".bang.In that case we need to repair it refer KB258062 | |
| is not so dangerous but still doesnot allow u to work properly sendil velan | |
| Lässt Explorer abstürzen Eierschädel | |
| Lsass.exe file is a virus and Shutdown Systems Automaticaly. I have already faced this Problem. My OS is windows 2000 and Used shutdown -a but it not a suitable with Win 2000. System Restart after 60 Seconds. so I am not able to work on my System. Ritesh Bhardwaj | |
| it restarts the computer after few minutes gurpreet | |
| I dont know much.. But its a REAL PAIN when im working , and it says i HAVE to reboot my pc due to an error or something, im getting close to calling microsoft about it, Its driving me mad, Paying $300 for windows 2003 and getting errors and other stuff Syflop | |
| do not know about this file but some dumbos like me thought it was the isass ( the one which begins with i not L ) but wasnt. john Doe | |
| problem at startup uday | |
| i kno that it restarts your pc and only gives you 60 seconds to save everything Andrew | |
| DO NOT DELETE! removing this file will cause windows to stop functioning it is required for security authentication, if your machine is shutting down chances are you have the sasser worm, see symantecs website for details on removal Brendan | |
| security while entering into network Samuel Devadoss | |
| Appears out of now where, Good firewall will stop it. Knute | |
| Its dangerous when you got a blaster worm, when ever you go to the internet lsass initializes a shutdown of your computer. Filip Baba | |
| Just a windows file. If it reboots your PC you are infected by a virus (also if you have a new computer, you just need to connect to internet to get the virus) | |
| when browing it logs you off and reboot the system FEHINTOLA SOBUNKOLA | |
| local security server Abhishekmathur | |
| some spyware removers can order you to remove lsass.exe. Only do so when it is not located in win\syst32\ otherwise windows wil not start the next logon. d. | |
| It'll completely disturb my work and will always shut down every system that i'm using. I'm a freeters that usually working with the computer and this worm cannot be removed or deleted as i've tried before... At the end, I need to reformat my computer and reinstall all the software i want to use.. | |
| Window system file. Not a problem! RedRiver | |
| LSA Shell (Export Version) has encountered a problem and needs to close. We are sorry for the inconvenience. | |
| It is very irrtating. As you go online, after sometime, the reboot dialog comes with a time span 60 seconds. Thing is you can't even terminate this app. I am using Win 2003 server, someone suggested me to go into COMMAND mode Use command "SHUTDOWN -i " and set the time = "99999" but I found out the "OK" button Grayed out .! 11 Jordi MannSlayer | |
| Important windows process. Only gets the shutdown notice occassionally when the virus tried to get in.After rebooting works perfectly fine for about a few months Leow | |
| I cant log in to my computer it says It is missing Lass.exe and when i click OK it restarts. Sydney | |
| The "System error: LSASS.EXE" error may occur because the OOBE cannot reset the Machine registry key before the computer is restarted.1. Start the computer with a Windows XP CD. Enter the recovery console by pressing the R key, and then logging into Windows. Doing so opens a command prompt. If no administrator password exists, press ENTER. 2. Type the following at the command prompt: cd D:\i386 3. Press the ENTER key. If the error "The system cannot find the path specified" appears, enter the following paths, in order, until the error does not occur: cd D:\Windows\i386 cd C:\i386 Michael | |
| This is not a dangerous dll, it is necessary for the Windows operations system. It is not to be confused with the worm, which looks the same. Look: "Isass", "lsass". The first one ther is in fact a capital "i", not a lowercase "L". If it is spelt with an "i" (or any other letter, for that fact), it is the worm, but if it spelled with and "L", then don't delete or stop it, it is nesessary. Ryan | |
| it is not a virus or any. this is system file this problem is windows file (lsass.exe)file is unable to process, or the file function is incorrectionly some causes.causes are I don't no. Phaneendra | |
| I am a CompuITA Certified Virus Inspector, this program is not a virus Xwassac Studios | |
| runs ping.exe multiple times and shut downs the computer where i do cmd or msconfig or regedit No name | |
| the file "lsass.exe" is NOT a worm. "lsasss.exe" IS a worm called the sasser worm which takes advantage of the vulnerable lsass.exe process. do NOT stop this process i know all | |
| I have no problem with this file in Windows XP. However, on Windows Server 2003 with IIS installed, this thing keeps restarting my dear little server, which connects to some twenty clients. It's not a virus. But there's a bug inside which brings up the problem. Teehee | |
| ISASS.exe: An invalid Parameter was passed to a service or function, How can I solve this problem? Masud | |
| It constantly uses the 500 UDP port,, could anyone please tell me if this behavior is correct? earamosrico | |
| It appears suddenly and it shutdowns my system within 60secs and when my system reboots it again reappears and says it will shutdown again.I am fed up of this and I formatted my system completely. Its definitely a dangerous virus.Make sure to stay away from this harmful virus.It is definitely a virus only as no system file will ask you to shutdown abruptly within secs again and again. Naseer | |
| if it keeps happening just create a new batch file with this code: ":START" (newline) "shutdown -a" (new line) "GOTO START". then run it and the computer wont shut down Josh | |
| shutdown randomly(winXP&win2k) - 'windows\system32\isass.exe' terminated unexpectedly with status code-1073741819 -just need to update ie n run windows update atokfly | |
| If you find a PC that has a clean copy of the lsass.exe and msgina.dll, copy those files and overwrite them into your windows/system folder...problem solved. David | |
| It is a windows component but when infected it causes much trouble shutting down PC automatically after 30 min. period, process closed by NT/Authority it's still giving me trouble I have Avast! Antivirus and have run the patch in Windows, still not removed it might be some kind of worm called blaster or sasser but cant clean it yet, I consider it's dangerous. Edward R. | |
| It's a WinXP vulnerable procces, he can execute remote functions, it get's infected by trojans. Can be fixed by updating windows Borz Sergiu | |
| we have experienced this issue in win XP, for the temporary solution, we give shutdown -a in the cmd prompt, how to troubleshoot in win 2000 prof. Dayanand.J | |
| this file lock your computer if u leave the computer for more then 15 minuter.then u must restart. if u r adminstrator of the computer Iftikhar aziz | |
| Don't confuses Isass.exe with Lsass.exe, under the right font they look the same. "I" is the virus "L" is a real system file Rissacher | |
| This is the Local Security Authority subsytem, responsible for authenticating users on your system. Services such as Net Logon and Security Accounts Manager use it. Maur | |
| whenever i connect my ethernet cable to my pc, an error pops up with some error code which shuts down the computer within 60 seconds. bapin | |
| This file is not a virus. I think virus is isass.exe find it first. Rubel | |
| This is system file not it is used the xp if we can't be deleted and it self replicated file so don't delete it if it runs pls run the command Shutdown -a it shop the lsass.exe then you logoff the computer and the shutdown it Pathan Nisar | |
| I'm infected with the Isass.exe worm. I'm not even able to log into my user, so how can i remove the problem by scanning it since i can't even start up any programme. Please, i need help here. Madison | |
| To my knowledge, lsass.exe is NOT dangerous. DO NOT DELETE IT. I was infected with the sasser virus, and I deleted lsass.exe to try and fix the problem. Well, all kinds of hell that caused. The computer, when started/rebooted, simply gave me a black screen. As cute as that may sound, it's kinda annoying when you can't get into the computer at all. Remedied this problem by fiddling around a lot, installing a new trial-based version of Windows, replacing the file and deleting the temporary OS I created. I would reccommend NOT deleting that file. Rather, open 'RUN' and enter "shutdown-a". spirokimino | |
| Everyone with arrow all the way to the left has a clue, any where else, you're confused....(c; PLY | |
| When I got isass.exe I ran a boot time scan from "avast antivirus home edition". So far it has cleaned the virus out.... I recommend Avast Home Edition (free) because of the capabilities of a boot time scan. You can download Avast at the link I have included. See also: Link Caleb | |
| only what i read tonite and the last time i tried to log in i got a warning someone had accessed some of my files steve | |
| Creator = Microsoft / Windows = Local Security Authority Subsystem Service Arnco HELMI | |
| Freezes windows xp sp2 when running mcafe 8.0 enterprise memory scan Arturo Lorenzo | |
| lsass.exe not a virus.its a molwer or spyware.if can be remove by any antispyware software of antivirus. | |
| This is the local security server, it's not a frigging virus, by it or any other name; it is REQUIRED to run your pc, if you get the message that it caused the system to reboot, it is because the sasser virus crashed lsass and your PC is rebooting as a result. IF YOUR COMPUTER REBOOTS STATING THIS YOU HAVE SASSER. | |
| Local Security Authentication Server Win NT4/2000/XP/2003 verifies validity of user logons to PC/Server Important part of OS path is C:\WinNT\System32\LSASS.exe (WinNT/2000) C:\Windows\System32\LSASS.exe (XP/2003) Williggin | |
| systemdatei | |
| it has password and login info in it,,and it accesses the net,,its prohably needed but i can see exactly why the lsass virus targeted it dan | |
| LASASS.EXE its coming with the windows xp , 2000 ... so its not a virus but its better to block it by the firewall and its ok mirna | |
| A system File, (incase you didn't read the previous million posts) not dangerious, but essential, confused with isass.exe by the sasser virus, it you have it then download a anti-virus program to get rid of it such as Avast free, avg free bitdefender etc. Also, make a batch file with shutdown -a in it and then put it as a quickkey, so that it will not shutdown durring the virus removal Linux For the win | |
| It restarts when u run .exe files especially antivirus software and .txt files. UTP | |
| Authentication process apparently requires disk I/O every second or so 100% of computer "on" time. It's a hog. It shouldn't require so much resource. john | |
| Is required to make an internet connection. If you stop the service it will timeout and restart the PC for security reasons! | |
| isass.exe or lsass.exe 2 different things but people think that is the same that;'s why is so many problems See also: Link mrsiwy | |
| lsass.exe is a SAFE and required Windows security process, do not get confused between this and lsasss.exe - which is the sasser virus TeeJay | |
| lsass.exe can hide elements of W32.Virut.A & PE.Virut.A. It will appear as IEFilter.dll & process 236. The best defence is a recent mirror backup, because it can also corrupt safe mode access. Astrocom | |
| i have this on my computer and there is no problem with rebooting at all or anything. Kristin | |
| strange process, seems to be killed at random if there is any winxp system in the LAN, zonealarm solves the issue, but not the problem Stelf | |
| You will regret deleting the file if you choose to delete it. It is safe by itself. Get a Grip | |
| leicht rauszufinden ob Virus oder Windows :). Einfach suchen wenn es in Sys32 is dann is es normal wenn sie woanders ist löschen ^^ dust | |
| LSASS.EXE (c:\windows\system32) is a part of Windows; ISASS.EXE placed else is a virus Peter | |
| This can be exploited by bots remotely and can hide the trojan process from being displayed in windows task manager, Resolution : update SP2 and ensure you kill all unknown processes using Security task manager! Keep safe! Alex | |
| Some one says it's a Virus, another one says its a system file. So I did some research, and found that it's a system file. but I'm getting crazy from my mcafee telling me "Trojan found" if I say "Delete the infected file" everything will be fine, however the virus comes back if i go back to the internet, Please Help Berry van Zanten | |
| LSASS is a vital process, but watch for the file "isass.exe", this is a trojan. Intruders try to make this file look like the original Lsass Paul | |
| sometimes viruses tend to diguis themself. | |
| well i know its on every computer made by microsoft. this cant be a worm. or it wont be on your brand new computer, its a worm gary | |
| it comes up on startup then when i go on the internet I just delet it ronsolostar | |
| The Lsass.exe process is responsible for management of local security authority domain authentication and Active Directory management. This process handles authentication for both the client and the server, and it also governs the Active Directory engine. The Lsass.exe process is responsible for the following components: • Local Security Authority See also: Link MICROSOFT | |
| The file is harmless. I got it with my new comp, from a reliable computer store. Perhaps this sasser worm thing just exploits the lsass.exe file in some way. Maniac | |
| The Local Security Authority Subsystem Service - Critical Windows service. It controls the security subsystem. Crashing this process will cause your computer to automatically restart. See also: Link Daniel Farst | |
| lsass.exe is not a virus. It's the isass.exe that is a dangerous virus that cause your computer to shut down in ca 60 seconds. SO STOP SAYING IT'S A VIRUS NOT A VIRUS | |
| I learned that lsass.exe might be harmful from McAfee Alan | |
| lsass.exe (Lsass.exe) tried to open a server connection to Mexico (traced IP with NeoTrace) shown from my ZoneAlarm program, why would this Harmless Program be trying to open a server connection to IP# 189.155.117.25 concerned | |
| be carefull. obviously if its up your computer and crashes unexpectably, its gonna be a virus. however... i have isass.exe on my comp and have had no problems with it, untill i tried to get rid of it. seems legit kev | |
| This is a part of windows server 2003. sometimes it causes problem with etrust antivirus. Tekchand | |
| If you have less than 128mbRAM then you will have trouble updating your computer. Put more memory in your computer and try again. Ben | |
| Lsass.exe a vital part of windows. NOT A VIRUS - If the last thing you did was a spyware removal eg ran spywarestormer then boot from windows cd and choose repair a windows installation this will actually work - if however if you do have the sasser virus then obtain stinger from mcaffee or the symantec equiv and run this tool through safe mode by pressing F8 at startup - the virus is detected and removed reboot normally and installed antivirus and firewall then update them - If you have played in the registry or have a damaged hard drive then delete partition and start from scratch See also: Link Rick | |
| Its a windows security file. It does not cause all the reboots but it does get crashed by the sasser virus which causes the 60s till shutdown thingy bad bob | |
| lsass.exe is not a virus. It's Microsoft's one of its gifts that came with Windows. If your computer reboots stating "lsass.exe", then you're bad luck because you got a virus in your system. :-( | |
| This is not a harmful file, just manages the authentication of various users on the system Yazdi | |
| seem to be a regular system process See also: Link John Andersson | |
| Open up task manager and try to end it. If it doesn't end, its not a virus. If it does, it's a virus. Virus | |
| go to run-cmd- and type (shutdown -a) or install service pack 2 styleeplus | |
| LSASS is an authenticater...most people are thinking of Isass.exe That is the Sass virus file. Look more carefully next time! Unix is my love | |
| lsass.exe can be infected by sasser worm.symantec has already released a removal tool. Also install Ms security patch. Links are given .. See also: Link Link Iftekar Ahmed | |
| This file is part of Windows, not even slightly dangerous. Mick | |
| like nearly all windows pocesses: if it is in the wrong folder it's a virus Mynx | |
| Typical broken microsoft crap with backdoors left in for whatever reasons. Opterational example at posted URL. See also: Link Know Your OS | |
| this is a normal process in machines, if that window appears it is a sasser's carchteristic. a way u can get rid of shutdown is by going start\run\shutdown -a Joey | |
| The Local Security Server of XP, if its not infected its ok, if it is infected then it is not the reason fo your problems but rather the result of them... papa | |
| Even giving new task run it wont support only safemode runs and other modes work with it, only few conditions by killing unwanted programs running in process success, final step only by reformating vamsee | |
| People confuse this file with isass.exe which is malicious. Uppercase i (I) looks like lower cas L (l). Chris | |
| lsass.exe has been updated and version changed to match the restore mechanism daniel | |
| its just a windows file but funny because it shuts down the computer if its turned off. davos1 | |
| Both exist with the same name, a WIN OS file and a trojan. I m currently infected. It disables run, regesdit, taskmanager and folder options. Does automatic system restart and deletes files important for installing anti virus softwares. its lethal and high stealth. shakti | |
| lsass.exe is the service responsible for authentication (verification) for user(s) logon to the workstations or servers. There is a worm named (Sasser) as defined by Symantec that accquires the same name also in the task list and causes system shutdown within 60 seconds; to stop this action type from the 'Start -- Run..' shutdown -a. It is important to keep ur windows and antivirus updated always. Sherif Khaled | |
| it's as mentioned a part of windows but it's dangerous when attacked, no need to worry about it; as it's a security proccess and all proccesses are virus vulnerable JAcKaSs | |
| the LSASS.exe Security Task Manager flagged for me, was located a few subfolders down, in the C;\Windows\System32\ folder. I quarantined simply because it was not where it should have been and everything's fine now. As it says above, it should be in your system32 folder. If it's not, then it's not the real Lsass, and is most likely the Sasser Worm. borracho | |
| Its at least a MS logon authenticator if in the System 32 dir. The Traveler | |
| Part of Windows security and local policies. Basically you need it to log on. If it fails, Windows will restart to correct the problem. If this is happening to you, repare/reinstall Windows. djbon2112 | |
| It is neither a virus nor is it harmful. That doesn't say that someone either has or hasn't figured out how to misuse, or potentially abuse it. Most criminal hackers will do anything to harm or damage a users computer. Jaffar | |
| A vital part of Windows - but- because it is a security component, it is attacked by malware. The Sasser worm, for example, partially works by attacking a vulnerability in lsass.exe. Other malware may replace it with their own software. Other malware may name something Isass.exe (capital "eye" instead of lower-case "ell") to conceal itself from the less observant. See also: Link Bren Flibig | |
| Its a windows log on process thats for sure, but it may be a trojan too as my computer no longer loads up windows. Error 'failed to initiciate (0xc0000005)' Paul | |
| windows process Maxim | |
| windows process - in win 2000 with connection to internet can't restart the comp Maxim | |
| Windows Security File. Good idea but a Bas**rd when it goes wrong Tim Ibbotson | |
| this is not a dangerous file all you need to do is patch your computer go to www.microsoft.com , and search for the file once patch your computer will not restart when you connect i have had this problem but is now gone... also if you would really want a real clean up (advance users only) restart your computer press F10 at least 10 times till a screen pops up , then click advance , next , then start it will then perform a system disk clean up deleting every thing on your computer except the files when you first ever got your computer , (may need disk) See also: Link Philip T | |
| It's just a windows xp OS function | |
| my avast! network shield detected and logged a lsass attack. "06.06.2007 16:40:41 LSASS Exploit (SXP) attack, from 220.207.69.55:445" justin | |
| LSASS.exe is not a virus, its the "Local Security Authority Subsystem ".But when its written with an i or "I" then its a virus like a sasser or anything else. try to delete it classhero | |
| as a IT-manager i can safely says thats its being used by your RPC (remote procedure call) i strongly advise you not to disable/delete it because you need to keep windows ME to XP stable and running and its being used by some network-services some USB-modems need them to even get connected to the internet, and yes it can be exploited by worms/trojans just install a firewall like zonelabs or sygate personal firewall and all will be well. to be short: don't delete/terminate/alter the file leave it as it is | |
| it is a virus which diable the option of taskbar, it will not let u open the msdos and the folder option get vanished from tools so that neither u can see this nor can delete it Amit Dey | |
| I canceled it and it shut my computer down with the one minute warning | |
| It is safe to block with a firewall, But do not delete it. but blocking it may prevent you from communicating with local computers. PaulZ | |
| This is the error i am getting on my computer right before it gets to the logon screen in XP Pro. When I click ok to the error message it just reboots the computer back to the same error message. Also does the same thing when i try to boot in safe mode. harish.dmvs | |
| If it is Lsass.exe (lsass.exe) then it is not dangerous. If it is isass.exe (Isass) then it is a dangerous virus. | |
| i found this on my computer but it was modified by virus (displayed the flash player icon) 2hot4u | |
| lsass.exe not dangerous if you don't turn on your windows updates.If you have problem with timeout and restart,its mean you have to format your hardisk and reinstall. See also: Link UpdateNeverBetter | |
| Destroy the packets thats out from the station, it seems that there is a connection (the green screen), even among the intranet. harmful in HP servers (& ISA software),Software dameges especially network softwares. Odwan | |
| If you Do have the Sasser Virus which can relicate the same file name - Lsass.exe or even a lookalike lsass.exe - Start your computer in safe mode and run a Virus scan, if you do not have anti virus installed, run your machine in Safe mode with Networking and download a free version. Sam Reynolds | |
| i receved lsa send dont send error in start up and my lasss.exe yn system32 17 kb nikunj vasoya | |
| It reebots the system everytime it gets to the windows start up screen Kummie | |
| Download AVG free scanner as fast as you can and run it, it it will get Isass.exe out Russ Browne | |
| Er, idk my firewall asked me if i wanted to deny the access to a DNS sever.. so i did.. but im confused.. and i need help.. so idk if i shall allow the access or leave it in denial.. : Chantal | |
| C:\WINNT\SYSTEM\LSASS.EXE infected by W32/Hupigon.MJH virus & seems to be a msp or msi file - virus or not, only my computer knows, driving me nuts! Becky | |
| it has stopped my audio completely.... swades | |
| I have a problem with lsass.exe.. it's not a Virus that's sure. but I have a big problem with it ... it takes CPU value in a range of 3-99 % up and down in a period of 1 seconds ... that slow my computer down toooo f***ing much! PLEASE help [email protected] Chris | |
| It is a windows file, but it CAN be infected... Symantec found a virus in the actual lsass.exe windows file.. Windows will run without it... but not too well. I need to reinstall. Don't recall the name of the virus now. electrowizard | |
| lsass.exe or Isass.exe, look the same, they are not, Lsass is not a virus but isass it is, becareful... See also: Link ticolandia | |
| C:\WINDOWS\system32\lsass.exe is not a virus, in fact it is a necessary program. However, lsass/ratsou.b are hiding behind it and will sometimes appear as C:\WINDOWS\Fonts\lsass.exe, as it did on my PC. It will really muck things up. I'm not rating it because, though the virus is horrible, the intended MS application is needed. K | |
| it asked to have connection with a port on the internet - i blocked it with sygate firewall. Adrian | |
| it constantly uses my computers memory. my task bar is always ranges from 90%-100%. thus making my computer slow. it always slows down my computer. Alvy | |
| Lsass.exe is a windows process, the problem is that lsass.exe uses the L lower case, Isass.exe uses the i uppercase. They look identical. Lsass.exe is ok but isass.exe is bad. sslawter | |
| is in charge of the userame and passwor authentication, however theresa variat of the virtumonde worm that anchors itself to this process and it is very dificult to remove, and may damage the paswors of all users including the administrator account Victor A Godinez | |
| Lsass.exe is not a worm, but a system-file. The Sasser-worm is the dangerous thing! It makes Lsass crash. So, the Sasser-worm attacks Lsass, and the computer crashes. Adrian | |
| This is a necessary component of Windows, not to be confused with isass.exe. Henry | |
| Part of the windows security Richard | |
| juz a normal file that protect agains security reason See also: Link jonathanycs | |
| i contacted my av ,they told me that this lsass should only be in system32 and not in a folder,if its anywhere else ,it could be a virus,as the hackers copy file names to attack your computer,as long as its in the correct place its ok annette | |
| Uses up a LOT of your CPU. Always a critical process. I only had it one day. never before with my 2 years of owning this PC has it appeared. Conor | |
| A remote computer repeatedly communicate with it at port 500, IP 220.237.11.48, or randw1.nsw.optusnet.com.au. user from Hungary | |
| it holds busy 99% my Dell Power Edge 2850 server on which window 2003 server ENT is installed and domain controller.if any on have any remidy for it, email me at [email protected] Murad Ali | |
| lsass.exe isnt virus but lsasss.exe is virus NOOBS not a virus | |
| Microsoft Local Security Authority Service: Windows critical process for user authorization and loging Elias | |
| why does lsass take up 50% of my CPU? It is very annoying because I run many things like Photoshop CS3, WMP, Firefox, and others at the same time often and I do need the other half of my CPU Rafterman | |
| Originally provided by Windows operating system, but some viruses disguise themselve as lsass.exe exuctable. Technik | |
| it's a local authentication server file required for user logon but it can also be a virus. in my case it deactivated the task manager, run command on start menu, search on start menu among other few things. i tried to remove it but to no avail. can anyone suggest? Vishal | |
| Do not confuse with isass.exe, Task Manager uses a font which shows upper case i identical to lower case L amwil | |
| NOD32 thinks its a VIRUS. See also: Link | |
| keeps files open on mountable drives so that you can't unmount them...typcially stupid programming from m$ paver | |
| booted up in safe mode and tryed to end task but denied, tried to remove it manually but denied Terry ist | |
| After boot-up and some web-browsing the Windows Task Manager shows more than 50% of the I/O writes belong to this process. See also: Link GeoFan49 | |
| If you have 2 of these process try ending process the real one will disallow it to be ended the fake one will be able to be ended like other processes Jamesernator | |
| in XP the file is used for security access. if it is corrupt, not running right, or even removed from the system32 directoy, you could get the "black screen of death" with only the arrow which will move around for a little bit. if lsass.exe is ANYWHERE ELSE then it may be a trojan. LEAVE THE FILE IN SYSTEM32 DIRECTORY! See also: Link Frustrated | |
| It can be a sasser worm virus, but even the real lsass.exe can hog up the CPU and make the computer run slow. I'm still looking for information about what to do about lsass.exe when it is not a virus. Pablo | |
| lsass.exe in the windows/system32 folder is NOT dangerous: it is the Window OS logon authentication process. lsass.exe residing elsewhere in the system (not in the system32) folder ARE dangerous trojans.. Chad | |
| Today I face problem with C:\WINDOWS\system32\lsass.exe missing and I am not sure how do I slove this problem, because I am not able to enter in to windows. Everytime I boot the laptop in the middle itself I am getting this warning. Can somebody help me plz.... Kumar | |
| Visible in the Task Manager as lsass.exe is ok and Windows requires it to run properly. Visible as lsasss.exe, you won't waste too many time observing how dangerous it is. Leave lsass.exe, destroy lsasss.exe at once! Sigurd | |
| This file is crucial for a VPN connection to function. The traffic to your VPN goes through this application. It is a windows system file(lsass.exe). huldu | |
| there is some thing new LSASS.EXE . It is all uper case and I tried everything and it's not going away NADIR | |
| has stopped my log in screen from even appearing. also unable to carry out any functions atall on my computer. any idea's? email me at '[email protected]' Paul | |
| Microsoft Local Security Authority Service: Windows critical process for user authorization and loging Tillionaire | |
| lsass.exe stops functioning download files from download software like Orbitdownloader etc See also: Link sachin s | |
| its a windows system file, the problem is when it crashes windows shuts down to prevent problems lainlives | |
| every time i boot my pc i get this error if i click ok it reboots i dont have acesess to anything girtha1134 | |
| It is used in windows startup.... Not at all harmful... Vipul | |
| lsass is a windows file. I'm with you on that but My problem occurred without warning just a reoccurring shut down without any type od OS load. meaning I can't run anything scan or otherwise. I'd be fine if i could get to a c prompt ..but i can't get that far. Also I have updates to sp3 any ideas? :) | |
| part of windows. lsass.exe | |
| it's not harmful naruto | |
| There's alot of info re lsass.exe on microsoft.com. | |
| make sure of what you are looking at... "Isass.exe" or is it "lsass.exe" or is it " sass.exe" choose wisley grasshopper. David | |
| when associated with the sys32\lsass.exe is importatn for logon authentication Schmiegels | |
| Two of Our PCs at our company have been shut down with an error message includes( isass.exe) we, as IT People could not access the windows again as the computers were hanged... at the end we formated them.. Hamad | |
| Critical for windows functioning. I force ended it just to see what it did, and my com immediately started a shutdown countdown. See also: Link Tw15t3r | |
| This file is a part of Windows(R). Nothing to worry about, but some files like this one in different locations may be a virus. COHA Systems, Inc. | |
| it may be a trojan named SASSER | |
| it ther in AppPatch file c:/WINDOWS/AppPatch , wat i do know. pop up always thru AVG. distrub my work. that's all abt it. sara | |
| lsass is a legitimate Windows object for user authentication but it is vulnerable to the sasser virus and can be HiJacked. Someone please clean up this place as at least half of the entries are worthless. Let's try and be useful here and not cloud the issues. SomeOne | |
| it's the NT LM Security Support provider. You can disable the service and you should still be fine. Been running w/out it for a few years. No malware. People get malware b/c they don't use good AV and FW. uncoolcentral | |
| Hallo? des is von Microsoft; alles von denen is gefährlich!! Apple User | |
| Have the error message for Bad Image C:\WINDOWS\system32\SAMLIB.dll - reloaded entire PC and when I connected bad to the network got the message again... reloading machine again and stil not sure how to get rid of error.. Saheyala | |
| lsass.exe is harmless and if u kill it, it's likely to reboot or revert to welcome screen. two famous viruses are lsass.exe begining with an "I" or ending in triple "s" no one | |
| While the "real" file is a critical part of Win security, this file is a frequent target of trojan/virus activity. Don't kill this out-of-hand, unless you really know what you're doing. A good anti-virus/anti-spyware should keep you safe. SatyrMage | |
| this is a system file.. and one of the essentials for the OS, but the problem is that... most exes can be replaced an exe with same name. If u suspect the exe is infected ... send it to www.virustotal.com and wait for the result. Cheers. ;) cute_snifer | |
| I need to stop the process so the internet browser can load a page. Halogen | |
| Seems to be dangerous. Kill it in task manager, then execute msconfig and remove it from startup. It seems that there is also a lsass.exe process that is from Microsoft, but you can see which one is from Microsoft and which one is not by the username listed in the process list (the dangerous one is running under your user username, the Microsoft one is running under SYSTEM) Domagoj | |
| when i boot my computer is has the "lsass.exe - application error" the message says the application failed to initialize properly (0xc0000005) click on OK to terminate the application. and it doesnt exit until you press "OK" and it repeats the message once afterwards then dissapears and its left on the current screen | |
| Systems operation...all normal. Apple sux | |
| I found it in my Application Data folder, and Nod 32 cleaned it up. Bob | |
| I have win7 64bit, and this file was 32bit, so it is a virus, because it is not a system file(would be 64bit too). The virus collects passwords. ugaJ | |
| It is A Virus SomeTimes ------ | |
| lssas.exe -insufficient system resources to complete the API | |
| i found lsass.exe message in our server,that mention traffic block , recently printer and some users showing as offline , is it problem of lsass.exe kabeer | |
| Isass.exe is a trojan, its cleverly named to look like lsass.exe but what seems to be a lower case L is actually an upper case I if you change your system font you will notice the diffrence xxthugxx | |
| "lsass.exe" is a legitimate WIndows process IF and ONLY IF it is running from the System32 directory. If you notice this running from another locations (I had it in the AppData/Roaming folder), open up task manager, kill the lsass.exe process and delete the file immediately See also: Link Tony | |
| consider where you/your av program finds it. if in system32 that's one thing. if in some user subfolder, delete delete delete. the one dave | |
| has been affecting web searching(redirects to random website) reboots computer irritated with norton support | |
| lsass.exe is a dangerous file. My AVG found it as a Sasser.Win32 or maybe it was a false positive. Kalka | |
| It doesnt show my desktop when it boots, i use windows 7. And i typed explorer.exe to get my crap back on like desktop | |
| it`s really dangerous (especially for slow and old PC`s) because it consumes a LOT of PC`s resources...also because of thoose restarts ... Kefyras | |
| If its not in the system32 folder then its dodgy!! i found it in the users location and anytime i attached a lan cable the system would restart, eventually removed it using HiJackthis and then updated my antivirus thru wireless and fixed it. TeHWaBB1t | |
| LSASS Stands For:Local Security Authority Subsystem Service. When You Terimate Lsass.exe All Its Users on The Logon Screen Will Be Gone And Then...Restarts The Computer Madisyn Williams | |
| Look out also for lsasss.exe (an extra 's' but not easy to spot) - I think that one *is* a virus Bob | |
| Its blocking my connection to internet. I'm using windows xp service pack 3. I used to connect internet using reliance netconnect. But now its not possible because of this Isass.exe file. How to remove it from my computer? Sachin | |
| Isass.exe with a capital I is harmless, but if the spelling deviates for example with a small 'i' issas.exe then it is a virus. Minimal deviation in the spelling of the original process is a sign of malware on your computer trying to fool you in appearing harmless. See also: Link Lucky | |
| If lsass.exe is not present in your \system32\ then it is indeed a virus. The legit lsass.exe lies within your system32 folder. It seems to like the AppData\Roaming folder. I just got this virus and removed it. See also: Link Akari Shinrai | |
| lsass.exe is a native executable for Windows. However, can be remove by some malicious program(Nothing is impossible in .bat). It reminds about CIADOOR.122 which is aliased as lsassa.exe... Noob Bobo | |
| it is not useful....it just uses ram for nothing making it slower :( Hablumiua | |
| my avg has 6 trojans on this file Anonymous | |
| According to Norton Antivirus 360, this one is the paid version, if the lsass.exe file is a risk, it will automatically detect the threat. Just be aware; If your computer starts restarting and causing unwanted messages, it would be better to get another antivirus scanner if your original one cannot detect it. lsass.exe severity was at a HIGH level. Velocity | |
| Isass.exe is a program for windows, But it's one of the top things that hakers like cus, it's so hard to pic up on the harddrive, and it has a format to kill everything, it can get enywhere without problems from the firewall, windows thinks it's a pertection software. If you have this running at start do a Virus scan. It takes 63 secs to shut down your computer. If you find it in the 32 system folder delete it. Not many anitviuses can find it. Again if you find it delete it | |
| Crashed my system | |
| If in C:\win = worm RapimmelKakazu | |
| it's a part of windows. though the sasser worm can make this and the hole computer to crash ... | |
| It is not a virus, it is used for system log on. User123 | |
| it can be a local security authority programm See also: Link The Virus Breaker Man | |
| i think it is created for security reasons; like as defined , it generates a token for user's access to the sytem. Arucard | |
| The correct one is 13312 bytes and 04/14/2008 22:00:42 Hardy | |
| it comes up everytime i boot up to desktop ter | |
| Can be Dangerous, once infected by worm IknowNothing | |
| A harmless file in itself but block other computers on the internet wanting to connect to it | |
| The process lsass.exe is the Local Security Authentication Server. It is a safe file from Microsoft and is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log. See also: Link Anita | |
| Not really affecting the comp I'm on much at present. Haven't received any shutdown warnings, but keeps on causing Trend Micro to block it and mark it as a high security risk. Based on what I've read here, there's a lot of debate about what it actually is. System scan shows it as clean, but the date on when it was created has me suspicious... Says it was created Feb 14, 2011, and last modified today when I accessed the Net. That's got me confused. Any answers on that point? Draco Weiss | |
| Local Security Authentication Server See also: Link LOL | |
| lsass.exe and sass.exe are two different things people. Use your Head | |
| ok its dangerous because, my child did not know how to handle it and in 3 dazs if you not repair zour windows crash, but the problem is bigger, zou can not instal any version of windows and i dont know why, thet lsass.exe eroor apearde and i could not open mz windows, so i decided to put another version but nothings work, pls if you have any ideas tell me becauze we can not stay much longer without a pc angy | |
| it just pops up a file that links you to Windows Explorer and when I start up my desktop doesn't load and i have to run explorer.exe manually. and when i search for this online it causes my computer to auto restart. goddamn deadly trojan :( NikoBellic055 | |
| Lucky: It's not ISASS, it's LSASS. nyuszika7h | |
| safe but depends on how ppl use it! See also: Link Shan | |
| Legitimate part of the Windows OS. LSASS stands for Local Security Authority Subsystem Service, and it (apparently) controls login info. It should be in C:\Windows\System32; if not, you need to go into Task Manager, end it, and delete, it's a virus. If you go into Task Manager and find lsass running under your username, find it in Explorer. If it's in System32, then run a virus scanner over it. If not in System32, end the process, thendeleteE. If the filename is ISASS instead of LSASS, end anddelete. Same goes with LSASSA. Austin | |
| I have one Isass.exe in folder C:\Windows\system32 (Description: LSA shell Export Version; Microsoft Corporation; Version: 5.1.2600.5512; Date created: 8/4/2004 6AM; Size: 13.0 KB) and another in C:\Windows\ServicePackFiles\i386 (Description: LSA shell Export Version; Microsoft Corporation; Version: 5.1.2600.5512; Date created: 4/13/2008 6AM; Size: 13.0 KB). The operating system is a Windows XP Professional PC version 2002 Service Pack 3. Gohemi | |
| Depends on original file location, must be in system32 file, use task manager to find location See also: Link Abstract Meta4 | |
| Integral part of Windows OS; validates logins, if corrupted is by users' negligence. Palindrome | |
| you really have to make sure it's not a fake by running an anti-virus scan on it. If it gets labeled a worm/virus then remove it. If your anti-virus says its fine, update the anti-virus and run it again. it's always good to be cautious, just don't overdo caution Neutral/Cautious guy | |
| The worm Sasser uses an exploit in lsass. Just be careful. Techwiz | |
| This is a Trojan steven | |
| Its causing my computer to Reboot again and again!!! Jibran Haidery | |
| it slows down the pc | |
| its safe and dont wory matin | |
| Open the task manager and click the "Processes" Tab Find the Lsass.exe under Image name If the user is SYSTEM then its fine If it says Lsass.exe and the user name is your name You have the virus. This virus spread throughout DOD computers worldwide. It is launched from an EXE autorun.cfg on external drives or thumb drives when you plug it into your computer and Auto run activates. Open up the external drive with hidden folders shown and delete the autorun.exe files on the drives. As for the computer, Create another admin account (control panel users add new user) reboot Log into the machine using the new profile with show hidden on, go into your main profile (c:\documents and settings :: or vista/7 C:\users) Locate the Lsass.exe file with shown hidden files on. The Lsass.exe is saved in the main folder of the user's profile (c:\documents and settings\username) use a shift+del for this file. Reboot the machine. The Lsass virus is gone... Just make sure you clean out your External drives... This virus spreads like STDS... Be mindful of what you stick in your computer’s USB holes... It has feelings too!! :) Jtate | |
| Mine is noted as "(unverified) Microsoft" [by "Process Explorer"]. Listed path is Windows\System32\lsass.exe 'Killed' it; (experimentaly); shutdown my computer. John Miller | |
| essential system process!!!! do not terminate the process or else you get a Blue Screen User32 | |
| This is reqiured for Windows XP. pawexjon | |
| My Norton system reports this file is using a lot of resources but finds no suspicious activity. Roy | |
| My firewall keeps warning that it wants access to the internet I have checked to keep it off permanently. I do not know what it will do. Bill R | |
| LSASS.EXE is now consuming over 1,270,000KB of memory! That's 1.27GB, and it's been rising the whole time I've been monitoring it this evening. RAM use for lsass.exe now stands at ,295,000KB. see if you need any help http://forums.techarena.in/operating-systems/1449911.htm#post5548238 See also: Link wintecher | |
| im running xp sp2. my problem is that lsass.exe is failing to initialize. since it wont initialize all i get is a black screen and an error window stating that it wont initialize. would it be alright to just replace it with one from another computers with xp sp2? please email me at [email protected] kronos | |
| As far as I know, with windows7, is that the lsass.exe file is also located in C:\Windows\winsxs....\ as well. The original post (top) says ONLY system32 wantowan2 | |
| Ok, just stop your commenting and listen to me! This is rated don't know because there are multiple types of this file. 2, to be precise. Before you think it is a virus, look for the symptoms. These are the symptoms: Adds the value: "avserve.exe"="%Windir%\avserve.exe" to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Use regedit to check this Creates a file at C:\win.log that contains the IP address of the computer that the worm most recently attempted to infect, as well as the number of infected computers. If none of these symptoms are on your computer, then it is not a virus. If so, you have the W32/Sasser.worm virus. If these affect your computer, you are almost screwed, and I don't know how to remove it, however I can tell you some handy advice. 1. The shutdown sequence can be aborted by pressing start and using the Run command to enter shutdown -a. This aborts the system shutdown so the user may continue what he or she was doing. 2. A second option to stop the worm from shutting down a computer is to change the time and/or date on its clock to earlier; the shutdown time will move as far into the future as the clock was set back. The answer to your problems | |
| lsass.exe id fine but Lsass.exe is nto safe See also: Link imyurhere | |
| This is a key part of a working windows system. The user opinions shown here illustrate clearly how following crowd sourced opinion can destroy your computer or worse! LetsBeSensible | |
| This file is not seen by me usually in my computer, but these days I am seeing it and it is using 100 % of CPU and system is very slow, I tried to end process it but I coudn't. Atif Malik | |
| Got hit for the second time by the Moneybucks scam virus. First time round it was contained in an exe called guy12.exe but this time it seems to be hidden in DLL files, executing as applications and named after standard Windows files (lsass, ctfmon and wlsidten). The files are showing up in the wrong folders (in TMP folders), and referring to each other despite clearly different functionalities. GCS | |
| Got virus that disabled TaskMgr (screen flashes then goes away) disabled System Restore, and disabled VirusProtection To fix: I ran procexp.exe (sysInternals tool), and saw 2 lsass.exe running (should only be one). Killed the bad one that was running from AllUsers folder, and then TaskMgr problem went away. After moving bad lsass.exe to another folder, when I rebooted, problem still there (running the bad lsass.exe from the folder where I copied it to). So I replace the lsass.exe in bad folder with the GOOD s\system32\lsass.exe version, ... Now investigating the AutoRun tool from SysInternals, which is causing explorer to start the lsass.exe at start up. I have re-enabled System Restore, but because of the disable, all previous checkpoints were removed (A bad design feature in my opinion). Joe Cole | |
| This file can be very dangerous and can do DOS attacks and disable LAN if is not in Windows/System32 Folder Morteza Niknam | |
| part of windows op lol | |
| lsass by SYSTEM is not a virus George | |
| It is only a virus IF something infects you're computer. So, if you have never received a shutdown message you're safe, if you have, you're computer has a 75% chance of it being a virus. Chris | |
| It is used for NT authentication | |
| lsass is a part of Microsoft Security is called by two services. These services are default configured to: adjust action recovery not allowed (via management mmc), service failure: restart pc. Service Name: SamSs (Security Accounts Manager) user data Service Name: Protected Storage (Protected Storage). private data ... whatever. Microsoft definition gives false impression, he is a smartass if security is not available, find another solution than this crap! Axel | |
| It is not a virus Hendrik | |
| I am doing a defrag of C: using the windows disk defragmenter. When I look at Task Manager, lsass.exe is churning out I/O byte writes like crazy, so this lsass must have something to do with file system management also. Bobbyrae | |
| This file is vital to the Windows operating system. To what I know, it operates within Windows 7 and is a module to assist in the Winlogon process. It's safe as long as it's from the "(drive letter):\(your windows directory)\System32" directory. Lildirt | |
| Safe, but...uses more resources than my anti virus while scanning. Thats real High, for a process that controls user log ons.Why is this so high especially if I'm logged on Tony | |
| The actual Windows process (System) is important. One that isn't in System is probably a virus. | |
| See also: Link heqta | |
| lsass is completely safe unless operating from outside system32. In order to prevent malware from attacking/abusing it, make sure to keep windows updated. Deeza | |
| its a system file use for authuntication Zee | |
| Safe system file if in the [Bootdrive]\[windows directory]\system32 folder. Note even the legitimate version of this file can result in a forced shutdown IF it crashes. John | |
| Hogs CPU time immediately after booting! Girish | |
| What is lsass.exe? Lsass.exe is a process used by Microsoft's Local Security Authority Subsystem Service. See also: Link CedFalz | |
| Because lsass.exe is a crucial system file, its name is often faked by malware. The lsass.exe file used by Windows is located in the folder C:\Windows\System32. If it is running from any other location, that lsass.exe is most likely a virus, spyware, trojan or worm. See also: Link Uros | |
| The file is an official microsoft operating system file but if it is compromised/replaced it could very well be a virus. If in doubt, best to check the file contents against the original file in your initial windows system backup or another installation of the same windows version on similar PC platform. WeDidntStartTheFire | |
| Use a lot of my cpu in google Shadow | |
| Forced GPU usage to 100%. It's a big danger for GPU. CIA | |
| This is an essential file for security authentication. If you run Discovery or other types of network identification software it is necessary. The fact that the process is attacked by some worm is irrelevant to file itself. Matt | |
| This is the Sass worm | |
| Its part of the Windows Operating system, often mistaken for the sass.exe file (the one you would not like to have on your system) See also: Link Harrie | |
| Avast found multiple instances of this file located outside where it should be. My PC was shutting down randomly, but since removal is now okay. Jordan | |
| I havent had any issues with it, and i've had this system for 10 months now Manikyn | |
| The (win32) file asks a lot to have access to system resources/registry....I'd keep my eye on this one if your system seems to be acting strange. MPD | |
| PC randomly reboots. Instantly closes your browser when you open it. Some keys from your keyboard may not work. End process "lsass" everytime you open your PC. Christian John | |
| "Because lsass.exe is a crucial system file, its name is often faked by malware. The lsass.exe file used by Windows is located in the directory Windows\System32. If it is running from any other location, that lsass.exe is most likely a virus, spyware, trojan or worm. Due to the way some systems display fonts, malicious developers may name the file something like Isass.exe (capital "i" instead of a lowercase "L") in efforts to trick users into installing or executing a malicious file instead of the trusted system file" See also: Link Min | |
| Microsoft Local Security Authority Service Bill | |
| Viruses use it as a fake name. Do not end the process unless it is running from a location not in Windows\system32 ! It will break things! T | |
| sometimes it prevent me from downloading... and takes up cpu. Roy | |
| Can cause BSOD SYSTEM_SERVICE_EXCEPTION when corrupted drivers cause large memory corruption. Andrew | |
| its a system file, sasser doesn't have lsass but Isass and such similar names. My_First_Name | |
| this is the scan https://www.virustotal.com/en/file/960ee6ec293b7cf62f2e6f49ed197783c7ad860e4dd23baa0200d300d31e8b56/analysis/1500057552/ See also: Link Ahmed | |
| It's a critical System file. The confusion comes from the virus with the same name that attacks this file. yay | |
| It's not a virus. Leo | |
| This File is not dangerous and is used by all Virus versions that i know of, i using W10 and this file is being used, terminating this process will cause windows to reboot after 1 minute. It will not allow any other power options. This file should be safe but is very easily infected and hard to remove. There are also ways to make viruses look like this file in the task manager, make sure that when you are in the task manager press the letter "L" it should highlight the process, that way you know you are safe. (can still be infected by a worm) Marcus | |
| Lsass.exe is a required Windows process. However, isass.exe/Isass.exe is associated with the Sasser worm. | |
| Lsass.exe is perfectly safe. isass.exe is not. This is 100% safe, and windows needs it to work. Bill | |
| MS Windows system file | |
| Critical system file. Causes forced restart when ended. Original product name: Local Security Authority Subsystem Service See also: Link iestinas | |
| Important System program ... Except if attacked by a worm. If you encounter system shutdowns, then run your virus removal program. Dave | |
| Critical system file. Causes forced restart when ended. Original product name: Local Security Authority Subsystem Service See also: Link iestinas | |
| The task bar does work if this process is working on your machine... Jansha | |
| it had a scam popup joe | |
| Its normal windows file Alfonso | |
| If it is in C:\Windows\System32, and the file size is 58.0 KB, and it is .exe, it is fully safe. d | |
| Is the memory integrity (Virtualization based security) 123 | |
| Task killing this process will shut down the PC in 1 minute. MsI0Tech | |
| Is the memory integrity (Virtualization based security) Joe | |
Show all 655 comments
More process information
Is lsass.exe spyware or a virus, trojans, adware or worm? Is there a known lsass.exe error?
Other Processes
csrss.exe ctfmon.exe desktop.ini dwm.exe hiberfil.sys logonui.exe lsass.exe lsm.exe mssearch.exe mstask.exe penservice.exe services.exe slsvc.exe smss.exe svchost.exe system system idle thumbs.db wercon.exe winmgmt.exe wuauclt.exe wudfhost.exe
[lsass.exe in German] [all processes]