We help IT Professionals succeed at work.

lsass.exe good or bad

wfcrr
wfcrr asked
on
Medium Priority
594 Views
Last Modified: 2013-11-22
watching "processes" via taskmgr, I keep seeing lsass.exe come up. What is that and is it ok?  I did a google search and am not sure it's a good thing.....it is the one with and "L", but lower case l as in lsass.exe.
Comment
Watch Question

Author

Commented:
so, thought I would try "end process" via task manager. As soon as I did that, Win7Pro OS said it had encountered a critical error and had to restart itself.  Makes me wonder if that process is part of the OS or what?  The article I read said it is a bad process?

http://www.processlibrary.com/directory/files/isass/20527/
CERTIFIED EXPERT
Commented:
lsass.exe is a system service.
There are anyway a lot of known viruses that will alter it ,which means that it has to be healed!
If not successful then via installing HD on another PC.
Any good antivirus would detect any altered lsass.exe
So if what makes suspect is only that sometimes it consumes CPU percentage ,then it is normal. If most of the time on 100%  it is a problem.
Technical Designer
CERTIFIED EXPERT
Commented:
If it is running from this location, C:\Windows\system32\lsass.exe, it is genuine and required for system to run properly.


Further you may like to use something better than Windows Task Manager. Process Hacker or Process Explorer.

Download:
http://download.sysinternals.com/Files/ProcessExplorer.zip

Info:
http://technet.microsoft.com/en-us/sysinternals/bb896653

or
Process Hacker:
http://processhacker.sourceforge.net/

Sudeep
CERTIFIED EXPERT
Author of the Year 2011
Top Expert 2006

Commented:
Please be careful of making this kind of comment: "Any good antivirus would detect any altered lsass.exe".

There are so many known and unknown variants of malware that it is really a stretch to make that claim.

Use the information recommended by SSharma and identify the actual file. Any suspicious/unknown files can be uploaded and scanned at:

http://virusscan.jotti.org/en

Explore More ContentExplore courses, solutions, and other research materials related to this topic.