Lsass.exe and smss.exe

By ahmado
Jan 23, 2009
  1. i recently checked using AVIRA ANTIVIR , it showed that lsass.exe and smss.exe where infected (in system 32 folder) and showed 2 choices : "DELETE" or "IGNORE" . what should i do ? is there any site from which i can download these files ??
  2. CCT

    CCT TS Evangelist Posts: 2,653   +6

    Try this first: do a Search for lsass.exe. You should see one in the C:\Windows\System32 folder and another in C:\Windows\Service Pack Files\i386.

    Right click the i386 one, copy, minimize the page, go to C:\Windows\System32 and paste.

    Do the same for the smss.exe.
  3. ahmado

    ahmado TS Rookie Topic Starter Posts: 48

    it says: "cannot copy: it is being used by another person or program.Close any programs that might be using the file and try again " .
  4. CCT

    CCT TS Evangelist Posts: 2,653   +6

    Then you may well have a virus/malware - I don't do those - head to;

    edit: I earlier was able to do the 'copy' thing but those 2 ARE critical OS items and cannot be stopped so I don't know why I was able to do it - lol.

    There were a couple reports of Avira getting false positives on those BUT it is always better to be safe than sorry, so go through the 8 steps and posts as directed.

  5. ahmado

    ahmado TS Rookie Topic Starter Posts: 48

    thanks very much
  6. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Avira is not incorrectly reporting lsass.exe and smss.exe as a false positive
    In other words they must be infected

    I'd suggest you backup any Userdata first (Even under virus infection) and then allow Avira to remove all found Viruses on your system
  7. CCT

    CCT TS Evangelist Posts: 2,653   +6

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...