Lsass.exe and smss.exe

[ahmado]

i recently checked using AVIRA ANTIVIR , it showed that lsass.exe and smss.exe where infected (in system 32 folder) and showed 2 choices : "DELETE" or "IGNORE" . what should i do ? is there any site from which i can download these files ??

 

[CCT]

Try this first: do a Search for lsass.exe. You should see one in the C:\Windows\System32 folder and another in C:\Windows\Service Pack Files\i386.

Right click the i386 one, copy, minimize the page, go to C:\Windows\System32 and paste.

Do the same for the smss.exe.

 

[ahmado]

it says: "cannot copy: it is being used by another person or program.Close any programs that might be using the file and try again " .

 

[CCT]

Then you may well have a virus/malware - I don't do those - head to;

https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

edit: I earlier was able to do the 'copy' thing but those 2 ARE critical OS items and cannot be stopped so I don't know why I was able to do it - lol.

There were a couple reports of Avira getting false positives on those BUT it is always better to be safe than sorry, so go through the 8 steps and posts as directed.

gl

 

[ahmado]

thanks very much

 

[kimsland]

Avira is not incorrectly reporting lsass.exe and smss.exe as a false positive
In other words they must be infected

I'd suggest you backup any Userdata first (Even under virus infection) and then allow Avira to remove all found Viruses on your system

 

[CCT]

Some people apparently beg to differ; see Avira forums;

Just Google 'Avira Lsass.exe smss.exe false positive'

http://forum.avira.com/wbb/index.php?page=Thread&threadID=71391