How to Remove LSASS.EXE

Lsass.exe is a critical systems component for the Windows operating system. It is part of the security gateway through which Windows users access the operating system and their personal settings. It is also a file that has been targeted by viruses due to certain vulnerabilities. If your lsass.exe file is infected with the virus known as the Sasser Worm, you must remove the virus to restore your system to full functionality. You should not, however, simply delete lsass.exe.

Things You'll Need

• PC with Windows XP or 2000
• Internet access

Instructions

1. Watch for symptoms of the Sasser Worm infection. These are easy to recognize; when a computer has this infection, Windows error messages pop up periodically with instructions to save work before Windows shuts down. These messages have countdown clocks on them, and when the countdown expires, the operating system reboots. This worm also creates error messages that say the program LSA Shell has encountered a problem and must close. If you do not see these messages, lsass.exe is functioning properly and should not be removed.

2. Purchase, download and install a reputable virus scan program if you do not already have one. Not all virus scan programs cost money; a link to a free virus scan program can be found in the resources section.

3. Launch your virus scan program and check for the latest software updates and virus definitions. The specific instructions for this vary from one software publisher to another, but it is usually very easy and is often an automated process by default.

4. Download the essential Microsoft security update related to this issue. A link to the relevant security bulletin can be found in the resources section. When you arrive at that site, find the operating system you use listed within the range of affected software and click the link next to that entry. Accept the download, and wait as the file automatically downloads and installs. You may be prompted to reboot your computer after this happens, but skip to the next step before you do.

5. Physically disconnect your computer from the Internet. If you connect through a cable, unplug it from the computer. If you connect through a wireless connection, turn off or remove the wireless adapter on your machine. Reboot the computer after you do this.

6. Launch your virus scan software and run a complete scan. Do not connect your computer to the Internet again until after the scan is complete.

7. Follow the recommendations of your virus scan software to handle any detected infections by deleting or quarantining them. After you've done this, you can reconnect your computer to the Internet with the confidence that the Microsoft security update and your virus scan software have removed the Sasser Worm from the lsass.exe file.

Tips & Warnings

• The file lsass.exe is located in the C:\Windows\System32 directory. If you find another file with this name located in another directory, it may be the Sasser Worm. Run a virus scan on any instance of lsass.exe that is out of place.

• If you delete lsass.exe from the C:\Windows\System32 directory, you may not be able to log back on after rebooting, and your computer may restart automatically, forcing you to restore your computer to a restore point made earlier. Windows cannot function without lsass.exe.

References

• Microsoft.com
• Technet.microsoft.com
• Processlibrary.com

Resources

• Free antivirus software
• Microsoft security update