Re: Issas.exe issue

LSSAS is a virus. LSASS.EXE (Local Security Authority Subsystem Service) is in the System32 folder.

John

davesplace54701 wrote:

John, I mistyped the file name in my original posting, the error message is for lssas.exe (that's lower case "L") when I search the hard drive I find a LSSAS.EXE-0670E652.PF in the Windows\Prefetch folder. I was under the impression that this is OK. it also shows that it was modified this morning about the time I received the error message and it closed.

"John John" wrote:


The correct name for the Microsoft Local Security Authority Subsystem Service is LSASS.EXE. Anything else is almost sure to be a virus or malware of sorts. Use your virus or malware removal tools to get rid of it.

John

davesplace54701 wrote:


Went through the device manager as suggested, no "exclamation point" icons, but thanks for the thought

"Mark L. Ferguson" wrote:



HiJackThis could find something, but running AdAware, and SFC indicate it is probably more on the order of a compatible hardware issue. Some driver for ME is not working in XP. Device Manager might show some 'bang' (exclamation point icon). Start/run, type: devmgmt.msc

AumHa Forums HijackThis log site: http://aumha.net/viewtopic.php?t=4075

After fooling around with this for a month, perhaps saving data, and doing a clean XP install would save you a lot of time.
XP Clean Install: http://www.michaelstevenstech.com/cleanxpinstall.html --
helpful? click "Yes" button. Voting helps the web interface.
http://www.microsoft.com/windowsxp/expertzone/newsgroups/reader.mspx?dg=microsoft.public.windowsxp.help_and_support
Mark L. Ferguson



"davesplace54701" wrote:



1) How do I make sure I have the correct lssas.exe???
2) Don't have Symantec on this machine, so can't scan for W32/Kedebe-D.
3) What is Hijackthis and how do I do that?
4) Did run disk clean and tried running sfc /scannow several times. Each time I needed to "retry" several times to get completely through the process.
5) Have also run adaware and Spybot
6) I am not familiar with Event Viewer, How do I access that?
7) Still get the lssass.exe error when I restart, and the entire system is bogged down and really slow.

"nass" wrote:



Adding to Mark Advice, since you upgraded from ME to XP?, it could be a layer of protection belonging to either a Hardware or a software, so check Hardware Compatibility first.
Make sure you have the correct lssas.exe, lssas.exe is a Local security authentication server for your system and can be troublesome if compromised by a Virus/Worm like:
W32/Kedebe-D
LSSAS.EXE then it's probably I-Worm.Sober.
W32.Nimos.Worm
http://www.symantec.com/security_response/writeup.jsp?docid=2004-031913-3938-99&tabid=2

Run a thorough scan from other vendors for both Malware and Viruses, make sure the Anti-virus on this machine is up2date and current!, run the Hijackthis and send the log to one of many forums specialised in analysing Hijack log.

Run Disk Clean up on this machine then open a run command and type in:
sfc /scannow click [OK], you may will need your XP CD for this operation to be accomplished, so get it handy.
Again, you didn't look in the Event Viewer for Error messages that can make life easy for anyone to help and give you the right fix!.
HTH.
nass
"davesplace54701" wrote:



Mark, the WikiAnswers site mentioned to watch out for a file called lssas (that is with a lower case "L") This is a legit file. Which is what I am having issues with.

"Mark L. Ferguson" wrote:



It is a backdoor virus that makes your system a zombie. Try Windows Defender to remove it.
Windows Defender home: http://www.microsoft.com/athome/security/spyware/software/default.mspx --
helpful? click "Yes" button. Voting helps the web interface.
http://www.microsoft.com/windowsxp/expertzone/newsgroups/reader.mspx?dg=microsoft.public.windowsxp.help_and_support
Mark L. Ferguson



"davesplace54701" wrote:



It appears as though I may have read the file name wrong. it is not Issas, but appears to be lssas.exe. Do appreciate the reply though. Thank you

"Mark L. Ferguson" wrote:



WikiAnswers - How do you remove the issas.exe computer virus: http://wiki.answers.com/Q/How_do_you_remove_the_issas.exe_computer_virus --
helpful? click "Yes" button. Voting helps the web interface.
http://www.microsoft.com/windowsxp/expertzone/newsgroups/reader.mspx?dg=microsoft.public.windowsxp.help_and_support
Mark L. Ferguson

"davesplace54701" wrote:


Just upgraded from ME to XP, now every time I start up my system I get the message that Issas.exe has a problem and needs to shut down. What is this and how do I fix it??


.

Loading