lsass.exe

lsass.exe is the Local Security Authority Service, which handles the Windows Security Mechanisms.

It verifies the validity of users logging on to your computer and generates the process responsible for authenticating users for the Winlogon service. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell.

Other processes that the user initiates inherit this token. lsass.exe is vital to the system and it is not possible to end this process using the Task Manager.

Located in "C:\WINNT\SYSTEM32\" on Windows 2000 and "C:\WINDOWS\SYSTEM32\" on Windows XP.

There are some parasites that uses lsass.exe filename to deceive the user:
Sasser Worm
W32.HLLW.Lovgate.C@mm
Mydoom
W32.Nimos.Worm

When the computer is infected with the parasite it displays a message:
"C:\windows\system32\lsass.exe terminated unexpectedly with status code 128. Your computer will now shut down in 60 seconds..."
Seconds counts to zero and shuts down the computer without user intervention. File lsass.exe is related to OnTarget. File lsass.exe is related to Pexmor. File lsass.exe is related to Rontokbro. lsass.exe also is an executable file that is responsible for launching parasites, loading main components of malicious programs and running a destructive payload. It is a significant part of a dangerous parasite, but can also function as a stand-alone threat. DO NOT run this file!
The lsass.exe file is installed and used by Satiloler, Satiloler.b, Satiloler.c, Satiloler.d, Satiloler.e, Crutle.b, Wowcraft.c.
The lsass.exe file usually runs the same named process. This process silently works in background and performs harmful actions. It remains active while lsass.exe is present in the system. Removing the file will immediately terminate a process and prevent it from running later. That is why you have to manually delete the lsass.exe file. If you cannot erase it, consider using recommended spyware removers, which will get rid of lsass.exe and associated parasites for you.
In some cases a presence of lsass.exe does not mean that your system is infected. The file may actually belong to some fully legitimate applications and therefore must stay intact. If you are in doubt, please scan the lsass.exe file using you regular spyware remover or antivirus program. lsass.exe is an executable file that is responsible for launching parasites, loading main components of malicious programs and running a destructive payload. It is a significant part of a dangerous parasite, but can also function as a stand-alone threat. DO NOT run this file!
The lsass.exe file is installed and used by Satiloler.f.
You have to delete the lsass.exe file immediately after you have found it. The parasite will continue to violate your privacy and harm your computer unless lsass.exe and all related objects will not be completely removed from the system. If you have difficulties erasing the file consider using an anti-spyware program.
Sometimes a presence of lsass.exe does not indicate that your computer is infected. It can be an essential system file or a file installed by harmless legitimate software and therefore may not pose any threat to your privacy and the system. Although such cases are quite rare, you should thoroughly examine lsass.exe before completely deleting or leaving it in the system.

Post Comment: