Can't delete lsass.exe

Hi,

For some reason i can't delete the lsass.exe file and it causing my computer to shut down automatically. When i try to delete it, it says disk is full but that's not true. My disk isn't full.. Does anyone know what i should do by deleteing the file?? Thanx for any help..

[stryder144]

Try hitting F8 when the computer reboots so that you can enter [tt]safe[/tt] mode. Then you "should" be able to delete it. If not, grab a copy of Knoppix, reboot the computer with it in your cdrom drive and then use it to gain access to your computer's hard drive. You should be able to [tt]rm[/tt] the file. If it allows you to do so, you should be able to reboot the computer and everything should be fine.

Cheers

[quote author=stryder144 link=board=25;threadid=9130;start=0#msg82586 date=1083413440]
You should be able to [tt]rm[/tt] the file. If it allows you to do so, you should be able to reboot the computer and everything should be fine.
[/quote]

what if the partition is NTFS? that could cause some problems if you delete something from an NTFS partition

Safe mode won't delete the file either. I have a copy of Knoppix 3.3 but don't know how to use it to gain access to my drive and rm the file. I got the copy from a mod a while ago..

[trickster]

I went to google, and typed lsass.exe.

This is the first response i got:

http://www.liutilities.com/products/...library/lsass/

It seems that it is a Windows service to authenticate logons. So, if you kill it or remove it, you kill your computer.

Remember how we have talked about how Google is your friend?

[quote author=trickster link=board=25;threadid=9130;start=0#msg82589 date=1083422012]
I went to google, and typed lsass.exe.

This is the first response i got:

http://www.liutilities.com/products/...library/lsass/

It seems that it is a Windows service to authenticate logons. So, if you kill it or remove it, you kill your computer.

Remember how we have talked about how Google is your friend?
[/quote]

Trickster,

A few seconds after i went to the link i got a message that restarted my computer. I don't know how to fix the lsass.exe to not restart. I couldn't even finish reading the link..

[quote author=dsantamassino link=board=25;threadid=9130;start=0#msg82592 date=1083434703]
A few seconds after i went to the link i got a message that restarted my computer. I don't know how to fix the lsass.exe to not restart. I couldn't even finish reading the link..
[/quote]

your system is probably pretty fucked up

just reinstall

ah this is it: http://isc.sans.org/diary.php?date=2004-04-30

you've probably been hit by the Sasser worm

as it says on slashdot:

The Internet Storm Center has issued a Yellow Alert due to the spread of the Sasser worm exploiting Windows 2000 and XP machines through a documented flaw in the Local Security Authority Subsystem Service (LSASS) as described in Microsoft Bulletin MS04-011. Initial analysis seems to indicate classic Blaster-style worm behaviour.

and here's the microsoft How To Fix My Fucked Up Windows page concerning the sasser worm:
http://www.microsoft.com/security/incident/sasser.asp

[trickster]

What about installing an antivirus, Derek?