Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Can I delete lsass.exe? svchost.exe?

Absolutely NOT.

These are required system files. Windows won’t run without them.

Do this

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

I'll see you there!

124 comments on “Can I delete lsass.exe? svchost.exe?”

  1. Hello i have windows 2000 im not a computer freak.

    I took my PC for formatting sevral times but as soon as i connect to the internet SVCHOST.EXE appears and then i cant copy or paste or disconnect and other annoying stuff.
    MY ANTI VIRUS IS UP TO DATE AND “STINGER” couldnt detect a virus it said that all my files are clean!
    HELP!

    Reply
  2. When i start up my computer i get:
    Couldnt open svchost.exe because dltime.dll could not be found

    When i press ok button it reapears and when i press ok for 3 times its gone
    This has had no influance on my daily computeruse but is just anoying on startup
    Please post me an answer soon.
    Thanks

    Reply
  3. Don’t know anything specific about that error. I’d probably have you run the system file checker, to start, and then a good spyware scanner.

    Reply
  4. When I’m running winmx and shut down my firewall (zonealarm 4.5) I get the windows screen indicating that lsass.exe has terminated and the system will shut down (w2k sp1 with all updates installed). My system scans as sasser-free and this error doesn’t occur under any other circumstances, so I believe it’s just due to the environment not the sasser virus. Can you confirm if other situations can cause the lsass to terminate (just plain old windows instability?)
    Also, a second question – the sasser update doesn’t install on w2k sp1, and they tech documents are careful to fail to mention it – is w2k sp1 not vulnerable to sasser, or is it wide open to sasser and the windows update wasn’t built to protect sp1?

    Reply
  5. Win2K SP4 (note, *4*) I believe has the patch as part of the SP. If you’re back at SP1, then that’s fairly old and wouldn’t have the patch. LSASS can manifest as a result of several viruses. This article has more: http://ask-leo.com/archives/000114.html – bottom line is to get behind a firewall, and scan for viruses often.

    Reply
  6. Hello There

    When I boot up my computer which is running windows XP home edition, Just before it gets to the log on screen I get error message “Not enough Virtual Memory or paging file quota available to complete this operation”. Then it reboots and does the same again. On the heading of the error message box it says Erroe – lsass.exe. I can not change VM because I can not get into windows (even in safe mode). I have important documents on there. What do I do???

    Reply
  7. Hi,
    when i connect to internet ,my system givem me a warning “system will shut down in one minute” and then it starts the count down and finally get SHUT-DOWN .

    what shall i do ? as this happens everytime i connect to internet .

    Suresh CHandak

    Reply
  8. I took my PC for formatting sevral times but as soon as i connect to the internet SVCHOST.EXE appears and then i cant copy or paste or disconnect and other annoying stuff.
    MY ANTI VIRUS IS UP TO DATE AND “STINGER” couldnt detect a virus it said that all my files are clean!
    HELP

    Reply
  9. yes that same lsass file keeps shutting down my computer even though i had the virus i erridicated it yet that keeps bothering me i tried almost everything to get it out but wayy it’s good

    Reply
  10. i have problem in my computer have still erroe is accoured when i start or restart my cpu ( svchost.exe path is not found ) and norton is already quarntian this file please tell me what can i do for this viruse
    saeed

    Reply
  11. go to msconfig console and in service tab unselect messenger. config ur update console and configure it any way u want and i think thats what i did when i had that problem. DONT OPEN ANY ATTACHED DOCUMENT EVEN DO U KNOW THE PERSON FIRST SCAN THEM FOR VIRUS.
    I HOPE MY INF WAS HELPFULL

    Reply
  12. whenever i turn on my server for the first time in the morning for about five minute its gives me a warning that it is going to shutdown it about one minute and after that i will click on run and type cmd and after that i type shutdown -a as i was directed by a website and nothing happen……I am using advanced server 2000….please help me about this…….

    Reply
  13. my real I.p is having a serious problem after gotten a new I.P address…Anytime i commect it to the internet all other system will not browse..and will show cannot find server…I tried to connect it to net2phone will a router of two port…Please…..

    Reply
  14. Ogbola: You need to read the two articles listed with this article. I can’t tell from your description exactly what’s failing when you try shutdown, but you may also need to grab a copy of “psshutdown” from http://sysinternals.com.

    Reply
  15. whenever i turn on my computer that connected to internet for about five minute its gives me a warning(lsass.exe) that it is going to shutdown it about one minute and after that i will click on run and type shutdown -a as i was directed by a website and nothing happen……I am using windows xp professional….please help me about this…….

    Reply
  16. How do I get my PC go to Windows?I get a lsass error that says—WHEN TRYING TO UP DATE A PASSWORD.THIE RETURN STATUS INDICATES THE VALUE IS PROVIDED AS THE CURRENT PASSWORD IS INCORRECT.
    Thanks
    Jack

    Reply
  17. Dear All,

    I am facing DOS attack problem n my LAN and my all PC broadcast the packets into the serial of real Ip continuesly.. how I protect our system

    Reply
  18. I did dlete all lsass entries inmy regedit on a windows 2000 server…….now what?
    I get a messages exactly the same as teh sassler virus but nothing helps, my servers reboot everytime I start them up with the error of the lsass.exe

    Reply
  19. when i work on my pc having and internet connection through LAN, the message appears as “lsass.exe terminated” and the systems shuts down after a period of given seconds(maybe 60 secs). kindly please assist me with this problem

    Reply
  20. “C:\windows\system32\lsass.exe terminated unexpectedly with status code 128. Your computer will now shut down in __ seconds…”

    This is the error I’m dealing with my pc connected to the internet through LAN, kindlly please help.

    Reply
  21. man my computer runs slow and my internet takes a long time to open a site. Ive talked to ever1 on battle.net and they say its somethin to do with the ping but its not. then they tell me to open taskmgr and tell them the stuff i have. i said svchost.exe,Isass.exe,csrss.exe,smss.exe,alg.exe,spoolsv.exe,wuauclt.exe,ipmon32.exe,kbd.exe and they said if some of them take more cpu isage then explorer that they were either a spyware worm or any other kind of virus so plz help my pc used to be good and now it is horrible and i am sad. plz help

    Reply
  22. man my computer runs slow and my internet takes a long time to open a site. Ive talked to ever1 on battle.net and they say its somethin to do with the ping but its not. then they tell me to open taskmgr and tell them the stuff i have. i said svchost.exe,Isass.exe,csrss.exe,smss.exe,alg.exe,spoolsv.exe,wuauclt.exe,ipmon32.exe,kbd.exe and they said if some of them take more cpu isage then explorer that they were either a spyware worm or any other kind of virus so plz help my pc used to be good and now it is horrible and i am sad. plz help

    Reply
  23. I’m receiving the little counter that shuts down my computer in 60 seconds. I’ve tried everything possible to fix this problem from my computer. Do you have any solutions to fix this problem? I’m running windows 2000 on my computer. What can I do?

    Reply
  24. Hello!!……..I keep running ad aware and my pc automatically shuts down……i checked for sasser virus but came out negative……..could my pc have another virus

    Reply
  25. Thanks for all the great help here and the articles above. I know lsass.exe is infected (and there may be multiple viruses)

    I’m running into a problem aborting the shutdown -a command on my Win 2000 SP1 infected machine.

    The virus has disabled the shutdown command. I can’t view the system32 or winnt folders (shows no files, even in explorer view). Can I run the shutdown -a command from the run dialog from a CD?

    “D:\shutdown.exe -a” doesn’t work.

    I’ve run every virus software and spyware detector I can find, and nothing has cleaned the machine completely. I’ve hand edited much of the registry for obvious problem files I have (internat.exe, defragfatx.exe, macaddr.exe, winmedplay.exe, and a few others).

    I am unable to install a software firewall, and I can’t run Windows Update. Most name-brand detectors seem to be diabled or uninstallable or un-updateable (ZoneAlarm, McAfee, Norton won’t work).

    Any help is a big help :)

    Reply
  26. Ya know… sometimes a system is so infected or messed up that the right thing to do is simply reinstall. From what you’ve described, that’s exactly what I’d start with: a reinstall of the OS on top of your existing installation.

    Reply
  27. I did a repair, and that didn’t work completely either. So, I think you’re right. I was trying to avoid that at all costs in case any of the data was infected, as this is a business computer.

    I do have another solution which I’ll share (thanks to my techie bro’s suggestion), in case I’m not the only one with this problem:

    1. Take out the hard drive and install it on a known-clean machine with updated virus scanware as a slave drive.
    2. Do not access the drive when you boot the other machine
    3. Do a virus and spyware scan (or three or four) on the slave drive
    4. Reinstall the drive

    Cher

    Reply
  28. When does the Q get answer’d anyway ? lsass.exe is a bitch i want rid too .I have deleted other viruses but this is messed , how is it done ?

    Reply
  29. i tryed to delet the file but i couldnt.
    it told me that it is being used and i couldnt shutdown the file but i couldnt.
    plz help me i dont know what to do when i do format to my computer i have this problems all the time i dont know what to do anymore plz help me i need help.

    Reply
  30. My PC was getting restarted bcoz of lssas.exe
    It says system will shutdown and countdowns for the timings. then I formatted my Pc then also i m facing the same problem. What to do sir???

    Reply
  31. My PC was getting restarted bcoz of lssas.exe
    It says system will shutdown and countdowns for the timings. then I formatted my Pc then also i m facing the same problem. What to do sir???

    Reply
  32. i did format again and i have the same problem.
    it happens only when i go online the internet.
    today it happend and i formated yesterday only, and it happend only when i got off the firewall.
    plz help me i dont know what to do im hopeless…:(

    Reply
  33. Leo,

    Do you know what the fix for this is: I have XP-P. My Internet Explorer home page and desktop have been hijacked. Uniquely, the same invader opens my CD drawer every few minutes and throws up a sign saying I urgently need their security system because I have “evidence” in my computer. If I put a CD in my drawer, the pc no longer recognizes it, the screen that should show that drive as opening on command is blank. If I put my CD into the second drawer, which does not open by itself mysteriously, the pc says I do not have a disc in it. This has made it impossible to back up my files for a re-format.

    Nortons 2005 SystemWorks and Nortons firewall has done no good, obviously. AdAware SE has found some objects in my registry but evidently cannot get rid of either them (although it claims to have at the time of scan) or whatever this intruder is.

    Since I cannot find a name for it, I cannot proceed in any way other than to get an expensive re-formatting.

    Hellp!!

    Thank you.

    Reply
  34. run stinger it will remove the sasser/blaster
    virus run sfc /scannow from the start run cmd
    if you have your xp cd try a repair to replace file after cleaning the virus

    Reply
  35. I have 6 windows task manger processes. isas.exe, spools.exe, msmgs.exe, taskmgi.exe, csrss.exe, svchost.exe. All of witch need to be deleted but i have no idear how to do the without messing up my system! could anyone help me?

    Reply
  36. Why do you say thel need to be deleted? Very likely that your system WILL NOT RUN WITHOUT THEM.

    What problem are you really trying to solve?

    Reply
  37. HI i am trying to delete isass.exe from my task mgr and from the whole system how could i do that i ran a virus scan it doesnt work, i deleted some some trojans or virus but that one is not letting me anyone know how, thanks..

    Reply
  38. Hello:

    I have found the lsass.exe in my strtup menu today and can not uncheck it or get rid of it. I have scanned with my updated Antivir antivirus and virus detected. the file started today and it is in C:\windows\lsass.exe and not in system files. Also it is in HKCU\software\microsoft\windows\xurrentversion\run. in regedit says localauthority service in the HKCU. I have checked its properties and it says microsoft file and on the registry. I have checked it and all indications seems its a real window file but I do not know what to do? I appreciat any help. I think I may havegot it whan I downladed two new antispyware such as xsoft and pc spyware and adware remover. I have uninstalled these programs but it is still there.

    Reply
  39. Get to know your computer better! :)

    As stated earlier, isass.exe can posibly be a virus, so run a full virus before you do this. Also run Ad-Aware (make sure you update these programs). I don’t recommend “Microsoft Anti-spyware program (as Leo does above {not the real Leo}) as it is still in beta and loads more processes than it stops. By the way, by all means Keep “Xoft Spy Remover” (one of the best, “Spyware Blaster” is another very good one)!

    ONCE YOU’VE DETERMINED NO VIRUS OR SPYWARE IS ON YOUR SYSTEM, PROCEED AS FOLLOWS!

    Open = “Control Panel” =next= Open = “Adminstrative Settings”!
    Now click on “Services”! Here you find all the services that are visable in your process manager.

    THESE ARE THE PROGRAMS NAMED ABOVE YOU NEED TO LEAVE ALONE!
    =lsass.exe (essential)=
    =spools.exe (if you use a printer)=
    =svchost.exe (maybe two of these with no problems=
    =taskmgi.exe (is the window u r looking at: Task Manager)=
    =csrss.exe (essential)=

    IF YOU DID THE VIRUS SCAN!
    =isas.exe (will be gone)=
    =msmgs.exe “Messenger”(of no use to normal user and is often used to spam you with Official looking Windows Popups. This is a very simple network messenger not same as an online Messenger Program.
    In the “Adminstrative Settings>>Services” you can right click/menu and choose properties. Click on the dropdown box next to it, Choose “Disabled”! If the process is running you can stop it here as well.

    If you want to experiment with other processes then first look at the icons in the “Services” page. You will see one on =mouse over= called “Export List”. Here you can save a list of the setup you have before you start tinkering. Preferribly get a screenshot of the “Services” page. This could save you if you make a mistake. But the saved screenshot will be much easier to decipher later. ;)

    Best bet, before you make any permanent changes is to just stop a process for awhile and then use your computer. See if everything runs all right. If it continues to run fine doing everything you normally do, then you know you can “Disable” it. But write the ones down you disable on paper just in case.

    Oh yes do have a “Firewall” installed and running. I recommend “Sysgate Personal Firewall”! It was recently bought by “Symantec” (Norton), but is still free and still better than their pay for one. ;)

    Reply
  40. hey why do you say I need to leave svchost? I once had something from the internet which slowed down my comp(very badly) called istsvc. I managed to remove it with task manager. now I have this svchost, I have 7 of them and they slow down my comp too(not that much as istsvc). From what I know they are bad and need to be removed. I don’t care if those things are not viruses or malware or they will mess up my computer, I just want to remove them. Please tell me how. I’m pretty sure that when I reinstalled windows I never had these things

    Reply
  41. Leo please explain the difference between Svhost and Svchost.exe the difference is a c and it a system file imitator like isass.exe is from Lsass.exe and most probably is a virus however i can freakin remove isass.exe i contained it with my firwall its not a Sasser coz neither Norton Anitivir Panda Titanium or Pc Cillen trend micro or all the (pay me im top on the list AV junk)doesnt sees it as a virus
    I got 2 process isass.exe(c:\Windows\isass.exe)(virus) and Lsass.exe(C:\windows\system32)(MS authen contoll whatever)now how to remove?!!!

    Reply
  42. Thanks for responding to me but I still need an answer for my question, may be you have not heard my question. My question is how can I remove some from google search? If you can tell me the intructions to follow or to perform.

    Reply
  43. I’m having an issue with isass.exe, lsass.exe, isass.pf and isass.pf. I ran my Antivirus and it popped up as lsass.exe is an infected file, and it wont clean, delete or even quarentine. How the hell do i get rid of this annoying little pest?

    Reply
  44. my system is suffuring from lsass.exe I want to remove lsass.exe for ever please help me how can i remove this voirus for ever

    Reply
  45. I see 6 or 7 svchost things running in my task manager. I assume they are needed so I will not touch it. I also see lsass, but after all I read, it must be needed. But what is winlogon.exe, spoolsv.exe, or services32.exe…I ave noticed when i do scans with Adaware and HijackThis that alot of services32, system32, and win32 things come up? What is wrong with my computer?? I keep getting pop-ups.

    Reply
  46. but Isass.exe is a trojan in windows XP home edition and also service.exe therfore do i delete this 2 trojans and if yes, HOW?

    Reply
  47. You can delete a virus by starting up in safemode. Then perform a search for the executable file. Find it and trash it immediately. You can only delete a virus in safemode, otherwise, if i you are using your OS in regular, the system will know its being used and wont delete it.

    Reply
  48. Anti-virus programs dont really do jack. pardon my jargon. I performed system scans for spyware and viruses, came out clean, but i still saw the spyware in my taskmanager and the scans read as clean. It is bull.

    Reply
  49. I was disabling some programs in msconfig and must have done the Isass.exe….my computer will not bootup up…it gets to the windows xp emblem and then goes black with the Isass.exe-error message. How do can I get passed it to enable the program?

    Reply
  50. i have at least 6 svhost.exe on my computer and the Isass.exe program, i cannot delete them, i triee running my anti-virus scan and it said there is nothing wrong, my coputer is getting really slow. can someone tell me how to get rid of it?

    Reply
  51. Try using regmechanic to make your computer faster, if that doesn’t work, try looking for other processes that are disrupting your computer. I currently have 6 svchost.exe running, or more, and my computer is fine. I also recommend computer cleaners, like “CCleaner or Webroot Window Washer.”

    Reply
  52. —–BEGIN PGP SIGNED MESSAGE—–
    Hash: SHA1

    Please read the article you just commented on.

    Leo
    —–BEGIN PGP SIGNATURE—–
    Version: GnuPG v1.4.6 (MingW32)

    iD8DBQFF5KPiCMEe9B/8oqERAusKAJ4rHGPPKke7+nT4c9WQZ4l/TiLQsQCfdACg
    p7c965dTvwarGQmIAoFNlUM=
    =Xwnf
    —–END PGP SIGNATURE—–

    Reply
  53. I have the same problem svchost.exe right off of start up is running and nothing else will run
    till I bring up task manager end task then I can start running programs again. but then later on iexplorer will run but evertime I close it an about/blank will pop up

    Reply
  54. i have deleted the lsass.exe in my system while using the anti virus. Still it is very slow and svchost.exe also present in my system. plz suggest me how to rectify this problem.

    Reply
  55. Please, do not even try to delete your svchost.exe-file. Doing that might destroy your system (not physically). It’s the main process, which opens other processes when you start your system. The scvchost.exe-file is infected if it causes viruses. It should be replaced with a clean one, which could be done by reinstalling your operating system. There might also be a program that could repair the file. Blocking the svchost.exe isn’t good either and if you attempt to stop it from the task manager it will send a pop-up with a timer. Then the countdown begins and the system will close in 60 seconds.

    Reply
  56. I moved svchost.exe to the recycle bin. Now my system is not working properly, for instance I can’t copy&paste or run a search. What do I do? Please help!!!!

    Reply
  57. Do not remove lsass.exe and svchost.exe!! these isn’t virus!! it must be infected by a virus!! if you exclude this files the system will not work right!! try to heal the file with an antivirus or replace with a clean file!!

    Reply
  58. I had a virus in my computer. I instalalled a new virus scan nod32 which detected the virus and deleted a lot of them, togather with this i guess it deleted SVCHOST.EXE. NOw when I startup my compute. I get a message stating svchost.exe not detected.
    I can’t open my taskmanager also, which probably could be because of this.
    I would like to know how can I Install an svchost.exe from and how can I get My task manager functiong

    Reply
  59. i cant seem to shut down my computer the usual way..instead i am required to open my task manager every time, end task ISASS. exe before i could turn it off… i believe it is infected by a virus or something…how can i resolve this?..please help.

    Reply
  60. Hi Leo, I have deleted lsass.exe & smss.exe after my laptop infected with Funny IST scandal from the registry. I was not aware that these are windows files and essential for system to run. Now I am not able to boot my laptop, is there any solution for this?

    Thanks in advance.
    Rajesh.

    Reply
  61. I’m confused, got a alert from norton internet security, indication low risk, so what to do block or grant access to the internet for lsass.exe, pls help. Thanks all for the comments.

    Reply
  62. Uh, Yeah, I kind of sent svchost to the recycle and screwed up my computer.
    I connected my stuffedup harddisk as a slave and was able to copy paste a svchost.exe file into windows32 but i cant seem to activate it.
    I really want my files back!!
    Everythings due at school now so acessing files is kind of crucial!
    PLEASE HELP LEO!!!!!

    Reply
  63. K, Leo,
    I’ve just read some more posts and im saddened to find out the SAFEST THING to do is reload windows. . . are there any LESS SAFE options that allow me to still keep my files?
    PLEASE HELP LEO!!!

    Reply
  64. Sorry Here is my predicament saidmore clearly.
    I deleted svchost.exe
    I found a copy of svchost.exe
    I put it in the windows32 file
    My computer sees it and says theres an error (sorry dunno what it is right now)
    Is there a way of properly activating it or fixing it.
    I wouldlike to avoid reloading windows.
    PLEASE HELP (Hope this was clearer)

    Reply
  65. hi Leo, can you help me w/ my problem of SVCHOST.EXE that is eating up my memory/cpu usage.. i’m using windows xp sp2,can i have a step by step manual correction for this matter…
    thanks!

    Reply
  66. Hello

    My svchost.exe i guess it is infected
    because each time i upload a file to my hosting, it looks fine, but after a while , i see a java script line added to my index page and this is malaware . in google my sites started showing that it this site might harm your pc.
    i made format to my pc, and again i was attacked by the same problem,

    I tried 4 different hosting companies, they said that someone has access to my passwords to do that, i changed password and still same problem.

    i was reading http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/

    so how to deal with that?
    thanks

    Reply
  67. I have three or more entries of svchost.exe in TasK Manager.
    When I end the svchost process with the highest CPU-time
    after som time i get the message that a shutdown is coming.
    For that I am prepared in cmd to abort that shutdown.
    Is this a virus.

    I have a screenshot of task manager but I do not know how to send it to you.
    Zone Alarm detected 55 attempts to go outbound.

    Before that I had 1175 viruses all of them with names of
    movies.
    I removed them with a trial of Avira Pro.
    I am using Virtual PC on a Mac G4 (QuickSilver) 2 processors
    and 1.5 Gb core.

    Have a nice day!!

    Reply
  68. Why does lsass.exe happily “export” data from my computer without my consent or knowledge ?. I observed this when I recently installed PC Tools Firewall Plus. Chunks of outgoing data was been recorded which originated from this program. Over 2 Mbytes had already been recorded as outgoing and about 1.5M as incoming by this exe.
    I have now used PC Tools Firewall Plus to completely block it and Nothing is now being “exported” nor received. Windows does not appear to have any problems with it being blocked from accessing the Internet.
    I was always wondering where the extra use of my bandwith was coming from and it now appears that I have found the culprit.
    SvcHost as far as I can see is essential but it shows no abnormal activity.
    So what is lsass.exe really is it Microsoft Spyware?
    What is it’s function ?

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.