The legitimate lsass.exe is a key part of the Windows login code.

  There was a period when a vaiety of malware was able to install itself 
by replacing this component.  If your system updates are anywhere 
near current, this should no longer be possible.

  Of course, the web pages that discuss the malware that took 
advantage of this lapse haven't gone away.

David Gillett


On 1 Apr 2009 at 18:23, Ray Parrish wrote:

> Hello,
> 
> A quick search on lsass.exe yields a ton of links on Live Search, and 
> Google, that indicate that lsasse.exe may be a virus, or trojan file 
> that you need to get rid of. It seems to come with a variety of malware 
> programs, one of which is a rouge pogram that professes to be an anti 
> spyware application, which tries to scare you into buying itself, to get 
> rid of the lsasse.exe infection it "finds" for you.
> 
> Other variants of it evidently have other uses the malware authors are 
> utilizing, according to the information on some of the pages I found 
> with the searches.
> 
> Here is a link to a page which will tell you how to get rid of lsass.exe. -
> 
> <http://www.411-spyware.com/isass-exe>
> 
> You will likely have to boot into Safe Mode to get rid of it, and it's 
> companions which are certainly on your system as well.
> 
> Here is a couple of quotes from differing pages which talk about a 
> couple of the variants this file manifests itself with.
> > isass.exe is registered as the Optix.Pro virus which carries in it's 
> > payload, the ability to disable firewalls and local security 
> > protections, and a backdoor capability.
>  From another site comes this quote. You should note that it references 
> a legitimate system process named lsass.exe which you should not be 
> removing, as it provides the user authentication process service on your 
> operating system.
> > If a process named isass.exe is running on your computer, you may have 
> > been infected with a strain of the Futro Trojan. Please be warned not 
> > to confuse this with the legimate system process 'lsass'.
> Here is a quote from a page that talks about lsass.exe
> > The process lsass.exe serves as the Local Security Authentication 
> > Server by Microsoft, Inc. It is responsible for the enforcement of the 
> > security policy within the operating system. This process checks 
> > whether a user’s supplied identification is valid or not whenever he 
> > or she tries to access the computer system.
> Here is a link to the Wikipedia article on lsass.exe
> 
> <http://en.wikipedia.org/wiki/LSASS>
> 
> And the following link to an article by "Ask Leo", shows you how to fix 
> the error you are experiencing with lsass.exe, which can be being caused 
> by the Sasser worm infecting your system.
> 
> <http://ask-leo.com/what_are_lsass_lsassexe_and_sasser_and_how_do_i_know_if_im_infected_what_do_i_do_if_i_am.html>
> 
> <http://tiny.cc/hov0I>
> 
> The second short url above has been generated from the longer on on the 
> Tiny Url web site, and links to the Ask Leo article as well. I have 
> included it just in case the long one doesn't wrap gracefully in this 
> email, and winds up breaking.
> 
> Here is a quote from a thread I was just reading, that explains that 
> sometimes there will be a file which appears to be lsass.exe, but is 
> actually named starting with a capital "i" instead of the default lower 
> case "l" of the original file. This file named with an "i" is a trojan 
> or virus file.
> > Lsass is the microsoft Local Security Authentication Server. IT is 
> > used to run firewalls and other security features. ISASS is not LSASS. 
> > Since the font used by task mgr makes Lowercase l and uppercase I the 
> > same, you can't quite tell them apart. Isass is a type of gateway 
> > worm, it first gets on your system, and disables your firewall, then 
> > takes a hold of LSASS' computer responsabilities, and shuts down your 
> > firewalls and other security features.
> Later, Ray Parrish
> > whenevery i start winxp i get this Isass.exe error message,this application failed to initialize properly(0xc015000f)click "ok" to terminate this application. after i click the ok i would get a black screen,my desktop will not load,i have tried using the windows advance option menu,every option that  i tried iwould get the same error and same result.can someone please explain how i can get rid of this Isass.exe.
> >
> >              Do you want to signoff PCSOFT or just change to
> >                     Digest mode - visit our web site:
> >                    http://freepctech.com/pcsoft.shtml
> >
> >   
> 
> -- 
> Human reviewed index of links about the computer
> http://www.rayslinks.com
> Poetry from the mind of a Schizophrenic
> http://www.writingsoftheschizophrenic.com/
> 
>              Do you want to signoff PCSOFT or just change to
>                     Digest mode - visit our web site:
>                    http://freepctech.com/pcsoft.shtml
> 

        The NOSPIN Group has added a new feature on our website,
           web based bulletinboard for questions and answers:
              Visit our sister website at http://nospin.com