Results 1 to 4 of 4

Thread: lssas.exe How to remove

  1. #1
    greyhair Guest

    Default lssas.exe How to remove

    Is this a virus lssas.exe?

    I am in the process of moving my programs and settings from my old pc to a new pc. I purchased software PC Mover in the hope that the transfer would be simple. However during the process I received a message ;The system is shutting down. Save all work etc. This shutdown was initiated by NT Authority/System message The system process G:\Windows\system32\lsass.exe terminated unexpectedly with status code -1073741674. System will shut down and restart.
    I was unable to use this software as even with a clean boot on both pc's before process it still shuts down. Tried several solutions and have now discovered when I look at the start up program panel by Mike Lin there is an entry under HKLM/RUN - Run these programs from the HKEY_LOCAL_MACHINE (all users) Run registry key.

    Name lssas Monitoring Startup Path lssas.exe

    According to the web this lssas.exe in nothing to do with Microsoft (lsass.exe) and likely to be a worm. I have scanned with ZA suite for virus/spyware but shows pc okay. I have also did a search for lssas.exe on the pc again with no results.

    I do not know if this file is causing pcmover to crash but can anyone advise if I can safely delete this file from my pc or is there a specific way to remove this? The icing on the cake would be if anyone can tell me why my system is shutting down when using pcmover. Their tech dept is trying without success so far.

    Any advice appreciated. Thanks

    Operating System:Windows XP Home Edition
    Product Name:ZoneAlarm Internet Security Suite
    Software Version:7.0

  2. #2
    naivemelody Guest

    Default Re: lssas.exe How to remove

    From ProcessList.com<hr>What is lsass.exe?lsass.exe (LSA Shell (Export Version)) is an executable from the software Microsoft
    Windows
    Operating System version 5.1.0 by Microsoft Corporation. lsass.exe version 5.1.0 is most commonly found under the directory &quot;system32&quot; with a creation date of August 23, 2001. This is not a known spyware, adware, or trojan executable. Microsoft Windows is the most widely used PC operating system.<hr>LSA Shell (Export Version) = Windows/system32/lsass.exe on the pc - it's essential, keep it.<hr>From neuber.com<hr>What is lsass.exe? Is lsass.exe spyware or a virus?<hr size="1">Process name: Local security authentication server

    Product: Windows

    Company: Microsoft

    File: lsass.exe

    Security Rating:

    &quot;lsass.exe&quot; is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token. More info

    Note: The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm!rom neuber.com<hr>Isass.exe - is a normal program of a pc - you can read this by Guru Oldsod -thanks<hr>Hi

    Is that Isass.exe or Lsass.exe?

    Lsass.exe is a legit Windows component, if it is in the C\WINDOWS\System32 folder. Just look for it and right click it and examine the properties. The time and date should coincide with the Windows Install. Plus the version and owner can be found verifing if it is from Microsoft.

    Yes there are worms and various malware posing as lsass.exe
    These should be held in check if you have all of Microsoft the updates. And scan with an updated antivirus.

    Dening access in the ZA Program Control will not stop it from runninng. That requires the &quot;Kill&quot; in the right click Options in the ZA itself. So yes, it will still appear in the Task Manager.

    It does not require Internet access or any server rights of any kind. Just Trusted Access and a three green bar rating. Ask for internet access is acceptable. [if you get to many alerts - maybe putting one green check there- may help]
    http://www.liutilities.com/products/...library/lsass/
    http://www.neuber.com/taskmanager/pr...lsass.exe.html
    http://ask-leo.com/can_i_delete_lsas...vchostexe.html
    http://ask-leo.com/what_are_lsass_ls...o_if_i_am.html
    http://www.processlibrary.com/directory/files/lsass/
    http://www.auditmypc.com/process/lsass.asp
    http://www.hardavenue.com/a/lsass.exe.php
    BAD LSASS.EXE....
    http://www.trendmicro.com/vinfo/viru...=WORM_SASSER.A
    http://www.pchell.com/virus/sasser.shtml
    http://www.bleepingcomputer.com/star....exe-9885.html
    Hope this helps...<hr>:8}NaiveMelody NYC 5-2-07~10:53pm e.s.t. - Get off of my cloud - The Rolling Stones

    Message Edited by NaiveMelody on 05-04-200709:00 PM

    Message Edited by NaiveMelody on 05-04-200709:00 PM

  3. #3
    greyhair Guest

    Default Re: lssas.exe How to remove

    Cannot fully see if it is L or I because of the font but there are two s's following it and only one s at the end before.exe. The microsoft file has one s at the start and two s's at the end before .exe
    Shall also explore the web sites you have given. Symantec mentions this as a W32.Sasser worm http://tinyurl.com/mmxcd
    which I hope is not on my pc.
    Thanks

  4. #4
    greyhair Guest

    Default Re: lssas.exe How to remove

    Thanks again for all the links. Helped me understand a bit more about lsass.exe and I did more full scans of my pc with various software and they did not find any virus/worms on my pc. This is reassuring but I am still at a loss why the pc shut down and restarted in a loop every 60 seconds. Forgot I could use Start/Run and typing shutdown -a command which aborts the pending shutdown. Decided to just re-install all my programs and settings manually and gave the pcmover the boot, although it looked a good program but obviously my pc could not cope and I spent too much time trying to get it to work.
    Cheers

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •