lsass.exe trying to contact my computer

17 years ago

Upon returning from being gone all morning, my firewall (Zone Alarm) tells me that lsass.exe is trying to contact my computer. I denied the request. I don't recall seeing this before, but the alert did say that the request had been made before (I think). When I looked it up, what I found says it can be a regular part of Windows or is can be a virus. I checked my alert log and didn't see anything there with "lsass.exe" in it, but there were many listed alerts that were blocked. Did I do the right thing?

Windows XP Pro 2002

SP2

Pam

Sort by:Oldest

Comments (10)

zep516
17 years ago
last modified: 11 years ago
The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm!

C:\\WINDOWS\system32\Isass.exeWhen in doubt up load the file here http://www.virustotal.com/

When you go to Virus total, Navigate to the above file up- load it wait for scan results, I'm sure your safe though.

Your next step is to run Malwarebytes if you want.

Here is a link that might be useful: virustotal scan
zep516
17 years ago
last modified: 11 years ago
Here is the file running on my xp machine, I notice Vista does not have the file,

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

4th one down in the list
zep
Related Discussions
How do i know if my computer is fully protected and how to clean
Q
Comments (51)
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:57:20 AM, on 3/24/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\MozyHome\mozybackup.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MozyHome\mozystat.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.oprah.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - (53707962-6F74-2D53-2644-206D7942484F) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - (A057A204-BACC-4D26-9990-79A187E2698E) - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Windows Live Toolbar Helper - (BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Windows Live Toolbar - (BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: AVG Security Toolbar - (A057A204-BACC-4D26-9990-79A187E2698E) - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - Global Startup: MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O9 - Extra button: Real.com - (CD67F990-D8E9-11d2-98FE-00C0F0318AFE) - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: (F04A8AE2-A59D-11D2-8792-00C04F8EF29D) (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: (F5A7706B-B9C0-4C89-A715-7A0C6B05DD48) (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\..\(4D7C7228-2B7C-4C19-AB8B-80BFC676C5B9): NameServer = 65.61.64.5,65.61.65.5 O17 - HKLM\System\CS1\Services\Tcpip\..\(4D7C7228-2B7C-4C19-AB8B-80BFC676C5B9): NameServer = 65.61.64.5,65.61.65.5 O17 - HKLM\System\CS2\Services\Tcpip\..\(4D7C7228-2B7C-4C19-AB8B-80BFC676C5B9): NameServer = 65.61.64.5,65.61.65.5 O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: MozyHome Backup Service (mozybackup) - Mozy, Inc. - C:\Program Files\MozyHome\mozybackup.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - http://www.greys-media.com/main.jpg -- End of file - 7561 bytes I am still seeing windows live toolbar on here..weird. I will have to go back into add/remove and see if it is still listed.. could have swore i removed it
...See More
New thread to try to solve computer problem please
Q
Comments (35)
I should mention that I just took AOL off my computer after 8 years. I understand AOL leaves bits of itself all over as well. When I followed your instructions I ran into a snag but tried to continue on. Hopefully Norton is gone. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:17:56 PM, on 4/8/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe c:\windows\explorer.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local F2 - REG:system.ini: Shell=c:\windows\explorer.exe F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe O2 - BHO: (no name) - "02478D38-C3F9-4efb-9B51-7695ECA05670> - (no file) O2 - BHO: Adobe PDF Reader Link Helper - "06849E9F-C8D7-4D59-B87D-784B7D6BE0B3> - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - "3CA2F312-6F6E-4B53-A66E-4E65E497C8C0> - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - "53707962-6F74-2D53-2644-206D7942484F> - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - "AA58ED58-01DD-4d91-8333-CF10577473F7> - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - "AF69DE43-7D58-4638-B6FA-CE66B5AD205D> - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - "DBC80044-A445-435b-BC74-9C25C1C588A9> - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - "E7E6F031-17CE-4C07-BC86-EABFE594F69C> - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - "2318C2B1-4965-11d4-9B18-009027A5CD4F> - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220" O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Symantec Network Driver Update Warning] C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [SRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /x "6AF90EF6-F7F9-466C-99F4-1774826FBB40> /qn REBOOT=ReallySuppress (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Symantec Network Driver Update Warning] C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [SRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /x "6AF90EF6-F7F9-466C-99F4-1774826FBB40> /qn REBOOT=ReallySuppress (User 'Default user') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Run WinHTTrack - "36ECAF82-3300-8F84-092E-AFF36D6C7040> - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - "36ECAF82-3300-8F84-092E-AFF36D6C7040> - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: ComcastHSI - "669B269B-0D4E-41FB-A3D8-FD67CA94F646> - http://www.comcast.net/ (file missing) O9 - Extra button: Support - "8828075D-D097-4055-AA02-2DBFA9D85E8A> - http://www.comcastsupport.com/ (file missing) O9 - Extra button: Research - "92780B25-18CC-41C8-B9BE-3C9C571A8263> - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Help - "97809617-3937-4F84-B335-9BB05EF1A8D4> - http://online.comcast.net/help/ (file missing) O9 - Extra button: Real.com - "CD67F990-D8E9-11d2-98FE-00C0F0318AFE> - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - "DFB852A3-47F8-48C4-A200-58CAB36FD2A2> - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - "DFB852A3-47F8-48C4-A200-58CAB36FD2A2> - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Ebates - "6685509E-B47B-4f47-8E16-9A5F3A62F683> - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) O16 - DPF: "01118400-3E00-11D2-8470-0060089874ED> (SdcNetCheckCtl Class) - http://activex.microsoft.com/objects/ocget.dll O16 - DPF: "17492023-C23A-453E-A040-C7C580BBF700> (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: "2253F320-AB68-4A07-917D-4F12D8884A06> (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab O16 - DPF: "231B1C6E-F934-42A2-92B6-C2FEFEC24276> (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll O16 - DPF: "6F750200-1362-4815-A476-88533DE61D0C> (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab O16 - DPF: "88D969C0-F192-11D4-A65F-0040963251E5> (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab O16 - DPF: "AD5AE604-34F2-4C7C-AEBB-14D424294A76> - http://www.interoagent.com/SyncInstaller/ReportGenerator/ReportGenerator.cab O16 - DPF: "B9191F79-5613-4C76-AA2A-398534BB8999> - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Documents and Settings\Ginny\My Documents\Jen\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- End of file - 9201 bytes
...See More
Slow computer and lots of stuff running in the background
Q
Comments (34)
I thought I had upgraded to IE7 at one point. Yahoo wants me to upgrade to IE8, but after reading about it here, I was reluctant to do so. I did go to windows updates last week to see if there were any I needed to do, but after scanning it said there were none. How do I get IE 7?
...See More
Is it my computer or is this site screwed up today????
Q
Comments (6)
Thx All... Seems like weird things are happening in our house (and cars ) right now. First, the drywall guys dropped the thermostat while cutting out a wall. That was several wks ago and we are still trying to find the correct part etc etc. Same week the garage door opener just quit working??? Our convert top would not go up this wkend during a terrible storm but, 3 days later is working fine?? The tv is not recording properly. Faucet Direct can't even find my order placed on May 18..altho it says it was to be shipped already??? So, I just thought maybe this computer thing was part of the week from hell LOL All in All the "normal" aspects of our remold job are going well.....:) Slow but good.
...See More
pfmastin
Original Author
17 years ago
last modified: 11 years ago
This is the result but I don't know what it means. Help? :)

Pam

File has already been analysed:
MD5: f1c69fd5009cd4219c8dca5df475d66b
First received: -
Date: 02.02.2009 12:23:40 (CET) [>43D]
Results: 0/39
Permalink: analisis/f576ee6d74f1376c954a6e66966905d1
zep516
17 years ago
last modified: 11 years ago
If that's the Virus Total Scan then there is nothing wrong, here is a bad scan it's actually from my sisters computer when it was infected so you can see if it were an issue Virus Total should have caught it, still concerned run Malwarebytes.

Bad scan below from virus total example:

C:\WINDOWS\system32\7LeXCtL7.exe ----- Below are the results from Virus Total.

Antivirus Version Last Update Result
AhnLab-V3 - - -
AntiVir - - TR/Spy.ZBot.fza
Authentium - - W32/FakeAV.EY
Avast - - Win32:Spyware-gen
AVG - - Clicker.TPX
BitDefender - - Trojan.Downloader.JLFE
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - Trojan.WinSpy.111
eSafe - - Win32.Zbot.fza
eTrust-Vet - - Win32/FakeAlert.KQ
Ewido - - -
F-Prot - - W32/FakeAV.EY
F-Secure - - Trojan-Spy.Win32.Zbot.fza
Fortinet - - W32/Zbot.FZA!tr.spy
GData - - Trojan.Downloader.JLFE
Ikarus - - Trojan-Spy.Win32.Zbot.fza
K7AntiVirus - - Trojan-Spy.Win32.Zbot.fza
Kaspersky - - Trojan-Spy.Win32.Zbot.fza
McAfee - - -
Microsoft - - TrojanDownloader:Win32/Popur.B
NOD32 - - Win32/TrojanClicker.Agent.NES
Norman - - W32/Zbot.BNO
Panda - - Trj/Sinowal.VVQ
PCTools - - Trojan-Spy.Zbot!sd6
Prevx1 - - Cloaked Malware
Rising - - Trojan.Spy.Win32.Zbot.fak
SecureWeb-Gateway - - Trojan.Spy.ZBot.fza
Sophos - - Troj/Dloadr-BXX
Sunbelt - - Trojan-Spy.Win32.Zbot.fza
Symantec - - -
TheHacker - - -
TrendMicro - - -
VBA32 - - -
ViRobot - - Trojan.Win32.Zbot.60928.F
VirusBuster - - -
Additional information
MD5: bef9d3070f9b71f4c44feff2b2b6ef6b
SHA1: 873c95b6060e334abc1457b98386bcdc05149929
SHA256: 7753603dcc99a4a4b1d4ad2aa9fe36118de7dbae1b6e1ff2c2b695650073817b
SHA512: 9a46147ed02d9006ce47cf34613df5d74363eea838cef0c49a6a64572ec99476761ed5cc6f8cea56a4756877a45722caa184aa867f91a2752c63a7248b1a3c6f
zep516
17 years ago
last modified: 11 years ago
Here are my results scanning the same file you did on my xp,

File lsass.exe received on 03.17.2009 07:25:22 (CET)
Current status: finished
Result: 0/39 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.17 -
AhnLab-V3 5.0.0.2 2009.03.16 -
AntiVir 7.9.0.116 2009.03.16 -
Authentium 5.1.0.4 2009.03.17 -
Avast 4.8.1335.0 2009.03.16 -
AVG 8.0.0.237 2009.03.16 -
BitDefender 7.2 2009.03.17 -
CAT-QuickHeal 10.00 2009.03.17 -
ClamAV 0.94.1 2009.03.17 -
Comodo 1060 2009.03.16 -
DrWeb 4.44.0.09170 2009.03.17 -
eSafe 7.0.17.0 2009.03.15 -
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.16 -
F-Secure 8.0.14470.0 2009.03.17 -
Fortinet 3.117.0.0 2009.03.17 -
GData 19 2009.03.17 -
Ikarus T3.1.1.45.0 2009.03.17 -
K7AntiVirus 7.10.673 2009.03.16 -
Kaspersky 7.0.0.125 2009.03.17 -
McAfee 5555 2009.03.16 -
McAfee+Artemis 5555 2009.03.16 -
McAfee-GW-Edition 6.7.6 2009.03.16 -
Microsoft 1.4405 2009.03.17 -
NOD32 3941 2009.03.17 -
Norman 6.00.06 2009.03.16 -
nProtect 2009.1.8.0 2009.03.17 -
Panda 10.0.0.10 2009.03.16 -
PCTools 4.4.2.0 2009.03.16 -
Prevx1 V2 2009.03.17 -
Rising 21.21.10.00 2009.03.17 -
Sophos 4.39.0 2009.03.17 -
Sunbelt 3.2.1858.2 2009.03.17 -
Symantec 1.4.4.12 2009.03.17 -
TheHacker 6.3.3.0.283 2009.03.16 -
TrendMicro 8.700.0.1004 2009.03.17 -
VBA32 3.12.10.1 2009.03.16 -
ViRobot 2009.3.17.1651 2009.03.17 -
VirusBuster 4.6.5.0 2009.03.16 -
Additional information
File size: 13312 bytes
MD5...: bf2466b3e18e970d8a976fb95fc1ca85
SHA1..: de5a73cbb5f51f64c53fb4277ef2c23e70db123f
SHA256: f7794b5d12dc5d820a162850f4388e2aa80426ad07cb221799cf941c682ab501
SHA512: c1f09ab3ad3b892f009270eb5325d801435ff2ffbf1354e66e333025634b707a
4cedf58a6b306efdddfcb1c010767983000d72dc5935240455f98f4490f551d4
ssdeep: 384:ggHUJZXmtGDWkzLWT4a8WfMptsN0BhgO49:338z4zRfMpy0BF4
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x14bd
timedatestamp.....: 0x48025186 (Sun Apr 13 18:31:34 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x10d0 0x1200 6.00 7d33d24893e1db0fa0ecbd7a8fa637bd
.data 0x3000 0x6c 0x200 0.20 86a789a893c60d5e207d053188cdc250
.rsrc 0x4000 0x1b30 0x1c00 7.15 54488850c25258396b2c9492c36b0bd5

( 5 imports )
> ADVAPI32.dll: FreeSid, CheckTokenMembership, AllocateAndInitializeSid, OpenThreadToken, ImpersonateSelf, RevertToSelf
> KERNEL32.dll: CloseHandle, GetCurrentThread, ExitThread, SetUnhandledExceptionFilter, SetErrorMode, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, RtlUnwind, InterlockedExchange, VirtualQuery
> ntdll.dll: NtSetInformationProcess, RtlInitUnicodeString, NtCreateEvent, NtOpenEvent, NtSetEvent, NtClose, NtRaiseHardError, RtlAdjustPrivilege, NtShutdownSystem, RtlUnhandledExceptionFilter
> LSASRV.dll: LsaISetupWasRun, LsapDsDebugInitialize, LsapAuOpenSam, LsapCheckBootMode, ServiceInit, LsapInitLsa, LsapDsInitializePromoteInterface, LsapDsInitializeDsStateInfo
> SAMSRV.dll: SamIInitialize, SampUsingDsData
zep516
17 years ago
last modified: 11 years ago
Your date on you scan is :

02.02.2009 12:23:40 (CET) [>43D] ?????
pfmastin
Original Author
17 years ago
last modified: 11 years ago
That's odd, zep...I just now did it and I've never heard of being able to do that before.

Let's be sure I did this right. I clicked on the link you gave me, clicked browse and then found the file under WINDOWS >>>>WINDOWS/system32/lsas.exe and clicked on it. It appeared in the blank space and then I clicked Send File. Was that the right thing to do?

Pam
zep516
17 years ago
last modified: 11 years ago
Yes it was so I don't know why, I think your worried to much about this file let it have access when it wants it's a legit Microsoft file running from the System32 folder, It's still a fine learning process though the things we did.

zep
pfmastin
Original Author
17 years ago
last modified: 11 years ago
Thanks zep! I'm sure you're right.
Pam
zep516
17 years ago
last modified: 11 years ago
Post a hijackthis log if you want. I'll look at it..

lsass.exe trying to contact my computer

Comments (10)

zep516

zep516

Related Discussions

pfmastin
Original Author

zep516

zep516

zep516

pfmastin
Original Author

zep516

pfmastin
Original Author

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

lsass.exe trying to contact my computer

Comments (10)

zep516

zep516

Related Discussions

pfmastinOriginal Author

zep516

zep516

zep516

pfmastinOriginal Author

zep516

pfmastinOriginal Author

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author