What is lsass.exe? Should I remove it?

lsass.exe — a system file that can be used to disguise malware 

lsass.exe is a legitimate Windows process known as Local Security Authority Service. Originally, the lsass.exe file is located in “C:\WINDOWS\SYSTEM32\” and cannot be ended using Windows Task Manager. If you terminate this task, it may lead you to various computer-related problems. Thus, doing that is not recommended. However, this file might be used to disguise malware. It is known that the process using the same filename has been used to mine cryptocurrency. This miner runs the lsass.exe process in the background of the system that pretends to be the legitimate executable. In the meanwhile, it misuses system's resources to mine cryptocurrency. To make sure that your lsass.exe file version is not malicious, diagnosis is highly recommended.

The legitimate file's version is a critical system component which shouldn't be removed as it is responsible for managing important tasks, such as:

• security policies enforcement;
• user login verification to Windows computer or server;
• handling password changes;
• creating access tokens.

However, if you find this file located in a different directory, not in C:\Windows\System32, or if you notice that it is using lots of computer’s CPU, it might be the sign that your computer is infected with malware. Unfortunately, cybercriminals often use the names of legitimate files to install or run malware on the computer. This is why you should detect the nature of this file and if it is malicious, remove lsass.exe from your computer.

There are a few instances when lsass.exe file was a crypto mining process on the computer. These attacks spread via different methods and the primary purpose of this malware is to run the process in the background while imitating the original one. The legitimate process is the local security authentication Windows process, but this fake one does nothing like that. 

The lsass.exe virus aims to mine digital money on the infected PC, during this process CPU and GPU is overloading. This is why your computer becomes unresponsive and crashing from time to time. Because of this malicious activity, your device might even display some error messages or blue screen errors. 

Criminals have been noticed using an obfuscated name of the lsass.exe where they used lowercase “l” instead of a capital “I.” In this way, inattentive computer users can be quite easily tricked by this hoax. You can suspect that your computer is infected if you also noticed these symptoms:

• the general sluggishness of the computer;
• crashing or unresponsive programs;
• an increased amount of ads;
• browser redirects to questionable sites;
• errors popping up on the screen;
• installation of unknown programs or browser extensions.

So, you may have a virus that runs the same named process and silently works in the background and performs harmful actions. Although the original process is nothing but safe, the issues might be caused by the corruption of this file. You may need to update the software or drivers and issues are gone. To check your PC, run a full system scan with reputable anti-malware programs. We recommend using FortectIntego and Malwarebytes. After this diagnosis, you may proceed with lsass.exe removal, if needed.

One click on infected email attachment can result in cyber infections

Original file arrives on the system together with Windows OS. However, the malicious file can be dropped using a couple of methods, for example:

• when a user opens a malicious email attachment;
• when malware-laden ad tricks into installing fake software or its update;
• when users download illegal or cracked content;
• when browsing via insecure websites.

Do not download or open suspicious email attachments from spam box. This section is automatically filled with useless letters and often these emails are infected. Advertisements or redirects are not that dangerous but cryptominers are no good.

Therefore, users are advised to be careful when browsing the web and especially downloading content from unknown sources. Always download software or updates from trusted developer’s websites. Do not rush installation processes and pay attention.

Remove lsass.exe if it is detected as malicious

Before you proceed with lsass.exe removal, you have to make sure that this file is actually malicious. You can do that by scanning the system using anti-malware tools like FortectIntego or Malwarebytes. If you accidentally delete a legit executable, your computer’s work will be disturbed. As a result, you will need to deal with computer-related problems.

The same security software will check the system and remove lsass.exe together with other suspicious components if needed. This way you can diagnose the infection and remove it if needed. Keep your anti-virus and anti-malware programs up-to-date so you can avoid any infection repetition in the future.