Forums mIRC Help About Lass.exe file

Hi,

I have download the singapore version of mirc program.
But it gives mi the above-mentioned file.

What is this file is all about? How to remove it?

Thanks in advance

Which Singapore mirror did you download from? Strangely, someone else reported in a thread a couple below this one about lass.exe appearing, also using a Singapore mirror. I've never heard of this before, and it certainly isn't on my system, and I downloaded 6.14 from the UK location.

Make sure you definitely get mIRC 6.14 from http://www.mirc.com/get.html ONLY. Even if the page LOOKS like that page, make sure you ONLY get it from that URL to be safe.

What directory is lass.exe placed in? Scan your whole system for a virus and see if any problems come up. Use this thread for some resources and make sure you use more than one.

Do you know when lass.exe appeared?

- when the installer was downloaded?
- when the installer was run and mIRC was installed?
- After mIRC was installed AND mIRC was opened?
- After mIRC had been installed, run AND closed?

Do you have any scripts running that may do this? I downloaded from mirc.vodien.com and installed, ran and closed mIRC, using $findfile with C:\ I found no lass.exe file at any stage of the installation.

Providing as much info as possible would be useful

Edit: It seems lass.exe is part of a trojan. There are also, apparently, 'legal' uses for that file name, including Local Security Authority Service. A search with Google turned up mainly trojan warnings however.
I highly doubt the mIRC mirror is distributing this. You have likely got infected some other way, read the thread I linked to earlier and read the possibilities, along with tips on how to stay safe in the future.

Regards,

Solution here.

Lass.exe appears once the installer is run, even if it did not complete it's installing mIRC. For me, there is an error message telling me there's an error caused by mIRC614 is an MSVCR or something similar.

Restarting the computer, there will be the message that LASS caused an error in ws2_32.dll.

Btw, I had downloaded from these Singapore mirrors, which are listed in http://www.mirc.com/get.html
http://mirc.wonderchat.com/mirc614.exe
http://mirc.rapidity.org/mirc614.exe

i have download from this website

And i use the mirror from singapore. Both mirror has the file and this the solution that you have given mi has the same as the thread that you have given me.

But the problem is that i can not be deleted away. It shows a access is denied. And i also using Zone Alarm.

Can you help mi by telling mi the steps of deleting the files?
I using the McAfee Anti-virus program and it has been up-dated since the day i download it which is yesterday..

The file http://mirc.wonderchat.com/mirc614.exe is not a valid mIRC installation file, it is nowhere near the size of a real version of the install file.

The .exe file contains this text: " -=þ PE-SHiELD v0.25 -þ- (C) Copyright 1998-2000 by ANAKiN [DaVinci] þ=- ", a program I have never heard of before. The download has either been virused or overwritten with another program.

I couldn't DNS mirc.rapidity.org.

How to delete it away? As it give me the error message of write-protected it. It's read-only button in the properties is unchecked. But it can not be deleted.

I just deleted the file as usual.

Usually that would imply another program is using it. Make sure you close ALL other programs (Including this page, as that means Internet Explorer is running) and most definitely mIRC. Close all the programs in the taskbar too, including MSN Messenger etc.

If you still can't delete it, scan your system with another antivirus. And another. And another. Don't just scan that file - scan your entire system. Use both virus scanners AND trojan scanners.

You may want to run your computer in Safe Mode. I don't know what version of Windows you're using, so see this page for a number of results.

I've seen the files "Lass" and "LSASS" been used together quite frequently. LSASS is what is attacked by the Sasser worm. I suggest you get your computer scanned and find more information about Sasser here aswell as make sure you have all the latest Windows Updates at www.windowsupdate.com.

Regards,

what version of windows are you running? My running OS is windows XP professional.

Lass.exe? What is that exactly?
The Local Security Authority service is LSAss.exe


Edit: Nevermind, answered my own question.
It seems that it's a trojan copy of mirc, usually installed as a "mirc update" or "mirc patch". (Obviously not a real update|patch)
It probably can be found in "%windir%\java\trustlib\com\" along with its script files.