Solved

Anyone know what lsrss.exe is??

Posted on 2004-07-30
3
356 Views
Last Modified: 2007-12-19
Hey experts,

I setup an apache server on a Windows 2000 machine a week ago or so, and an email came in from the web host saying that an IRC client was running on the server (this is a SBC dedicated host).  It's running from C:\winnt\system32\lsrss.exe.   Goggle doesn't turn up anything on this, so that made me worry alot.  Is this probably a virus or what?

-Chris
0
Comment
Question by:Discomonkey
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 34

Accepted Solution

by:
Dave_Dietz earned 50 total points
ID: 11679243
There is an lsass.exe that should be there, but there is no file I am aware of called lsrss.exe that should be running.

I believe you are correct in assuming a virus of some sort.

Check the version information on the .exe and if it looks suspicious kill the process and rename the file - then run a complete system virus scan.

Dave Dietz
0
 
LVL 1

Author Comment

by:Discomonkey
ID: 11679477
ran virus scan, turns out there were virus's on there but it had nothing to do with lsrss.exe.

instead its a service Eventask that was running on the machine.  The lsrss.exe process is dependant on this service.  Eventask is a service that was installed by the NT resource kit (srvany.exe) to run the lsrss.exe.  

it wasn't a virus, but I had viruses elsewhere anyway!!!
0
 
LVL 1

Author Comment

by:Discomonkey
ID: 11679479
oh ya, thanks :)
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Running classic asp applications under Windows Server 2008 R2 (x64) and IIS 7 is not as easy as one may think. It took me a while to figure it out while getting error 8002801d a few times. After you install the OS you will need to install the fol…
As tax season makes its return, so does the increase in cyber crime and tax refund phishing that comes with it
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question