What is LSASS?
"When I run Task Manager, I see a process named lsass.exe that is active. I'm worried that this might be a virus... should I get rid of it?"
|
|
|
| The Top Five! |
| Check out this week's most popular articles. |
Is LSASS.EXE a Virus or Spyware?
I can give you an authoritative "Probably Not" answer to that question.
That's because lsass.exe is an essential part of the Windows operating system. LSASS, the Local Security Authority Subsystem Service, is responsible for helping Windows manage security and logins. You should be able find the lsass.exe file in the C:\windows\system32 or C:\winnt\system32 folder, depending on your version of Windows. You should NOT delete this file, and in fact, Task Manager will not allow you to terminate the lsass task.
However, system crashes involving LSASS.EXE may indicate a virus or spyware infection. In April 2004, the Sasser worm exploited an LSASS vulnerability in Microsoft Windows XP and Windows 2000. Microsoft had already released a patch for this vulnerability, but many people failed to apply the Windows Updates patch in a timely manner and got hit with Sasser. Faulty code used in the Sasser worm caused seemingly random crashes of LSASS, but even on Sasser-affected systems, the LSASS.EXE file itself was not modified or infected. Word spread about Sasser and the LSASS vulnerability, and hysteria gripped many who were not affected, but noticed lsass.exe running on their system.
I have heard reports of a virus, trojan horse or spyware bearing the lsass.exe filename, so it IS possible to have a rogue LSASS on your system. The best way to be sure your system is clean is to run up-to-date anti-virus and anti-spyware software. If you don't have good anti-virus and anti-spyware software that does regular scans and auto-updates itself, you are vulnerable to much more than Sasser. See my article Should I Buy Anti-Spyware or Anti-Virus Software? for my recommendation on protecting yourself from these threats.
Got comments about LSASS.EXE or something in this article? Post them below.
Send this article 
Jump to the 
Buy Bob a 
Check out other articles in this category:Posted by Bob Rankin on March 3, 2006 07:10 PM
| Need More Help? Try the AskBobRankin Updates Newsletter. It's Free! |
 |
Prev Article: Going Viral - Internet Classics |
|
Next Article: Buying a Car, Selling a Car - Online |
 |
|
Link to this article from your site or blog. Just copy and paste from this box: Related Keywords: Security lsass virus spyware sasser |
Most recent comments on "What is LSASS?"
|
Posted by:
|
Would it be correct that if you did a search for all files and folders for lsass and found it anywhere except C:\windows\system32 or C:\winnt\system32 folders that would be a reason for concern? EDITOR'S NOTE: I think it normally shows up in I386 (with .EX_ extension) and maybe the DLL cache folder, too. Where did you find it? |
|
Posted by:
|
Very Useful information. |
|
Posted by:
|
Recently, MSN messenger has been starting up automatically with my computer, tries to connect to the internet and won't close (claiming another program is using it, so I must close that program first) unless I go to the Close Program window and close "Lsass" (which has never infact shown up in the close program window before). Is this supposed to happen? EDITOR'S NOTE: I would run a good virus and spyware scan... |
|
Posted by:
|
I too had lsass.exe running on my system for several hours at bootup, taking over 30% of my cpu. It turned out that I somehow got over 1,200,000 files in They all were created in January 2006 and didn't seem to serving a useful purpose so I took a chance and deleted them. Once I cleaned them out using CCleaner (taking over 3 hours) everything went A LOT faster. Since then I have gone through my c: drive and deleted over 75,000 other useless files, mostly MSMessenger ignore lists. My virus scan went from 3 hours down to 20 minutes. |
|
Posted by:
|
I think I have the same problem.. While using messenger 7.5, lsass.exe is stable and working fine... when my messenger didn't allow me to be online before upgrading the messenger (this starten happening today), I did upgrade it to microsoft live messenger.. After the install, when I tried to connect , it couldn't.. The pc was slower so I looked to the taskmaneger and there was lsass.exe, using my %67 CPU power.. EDITOR'S NOTE: How about removing the Messenger software that seems to be causing the problem? Uninstall it or use System Restore. |
|
Posted by:
|
If I enable the Messenger option to store my address book on the local machine then lsass.exe takes 100% CPU for several minutes while Windows Live Messenger is connecting. Disabling this option cured the problem. I didn't notice it with any earlier Messenger. |
|
Posted by:
|
I am increasingly disgusted by Microsoft's refusal to make software that isn't prepackaged with security vulnerabilities. Why does Microsoft get away with selling defective products? Its as if they do this purposefully for malevolent hackers and 3rd party software vendors to make money. My question is this, why are logon credentials among other things intentionally accessible to anyone on the internet? After a fresh install and offline update lsass and msdtc port 135 light up my firewall egress filter and its not doing so on 127.0.0.1. After detecting internet connectivity all this sensitive info is thrown out on the net without user consent. EDITOR'S NOTE: It quite a leap of logic to say that just because a DLL is connecting to the Internet that logon credentials and other sensitive info is being broadcast on the internet. What makes you believe that? |
Post your Comments, Questions or Suggestions
|
Ask Bob Rankin Home Page
Subscribe to AskBobRankin Updates: Free Newsletter |
|
|
Advertise on This Site!
Copyright © 2005 - Bob Rankin - All Rights Reserved |
||