lsass.exe trying to contact my computer

17 years ago

Upon returning from being gone all morning, my firewall (Zone Alarm) tells me that lsass.exe is trying to contact my computer. I denied the request. I don't recall seeing this before, but the alert did say that the request had been made before (I think). When I looked it up, what I found says it can be a regular part of Windows or is can be a virus. I checked my alert log and didn't see anything there with "lsass.exe" in it, but there were many listed alerts that were blocked. Did I do the right thing?

Windows XP Pro 2002

SP2

Pam

Sort by:Oldest

Comments (10)

zep516
17 years ago
last modified: 11 years ago
The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm!

C:\\WINDOWS\system32\Isass.exeWhen in doubt up load the file here http://www.virustotal.com/

When you go to Virus total, Navigate to the above file up- load it wait for scan results, I'm sure your safe though.

Your next step is to run Malwarebytes if you want.

Here is a link that might be useful: virustotal scan
zep516
17 years ago
last modified: 11 years ago
Here is the file running on my xp machine, I notice Vista does not have the file,

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

4th one down in the list
zep
Related Discussions
Slow computer and lots of stuff running in the background
Q
Comments (34)
I thought I had upgraded to IE7 at one point. Yahoo wants me to upgrade to IE8, but after reading about it here, I was reluctant to do so. I did go to windows updates last week to see if there were any I needed to do, but after scanning it said there were none. How do I get IE 7?
...See More
I think my computer is dead
Q
Comments (25)
Sounds like you've just about declared it dead :) If it is, it is, but I just wanted to try to narrow it down, and I didn't want to throw money around willy-nilly in the hopes of figuring out what the problem is. Your search took me to Ebay Canada. I took the liberty of changing the .ca to .com to get Ebay US, but with the same search. Why pay extra shipping if I don't have to? Like I said, I'm a novice at this, so I may not be entirely sure what I'm looking at, but from what I've noticed, I only clicked on the ones that had 3 memory slots (I have three sticks, so might as well use them), and from what I could tell, all the ones I looked at were listed as used, and total with shipping they still came darned close to $90. I did see this one below which ends in the morning (hopefully nobody here will sabotage me and bid against me!) and comes with a CPU which is slower than mine. I don't know the difference between a K8N-E and a K8N4-E. At least in the one I showed you earlier this morning, the MB was used, but the CPU that came with it was an UPGRADE to the one I have now. In fact, it's the fastest chip that can go in that board. The chip by itself (ATHLON 3400 CPU, 754 socket) is selling for $25US anyway on Ebay. I just thought overall, the whole repair would be cheaper, since I can replace my CPU for under $10, but if the going price of these motherboards means I'm going to wind up paying (total with shipping) $80-$90 anyway for a used board with no CPU, I just as well get the one with the 3400 in case my CPU is fried as well, correct? Thank you again, and forgive me if I'm being presumptuous. I just want to make sure I'm understanding correctly. If I'm wrong in any way, feel free to slap my wrist. Here is a link that might be useful: K8N4-E on ebay
...See More
Messed up my computer big-time
Q
Comments (57)
Thought I'd update. Got Windows installed without a hitch, Dell talked me through it. I debated whether to put Win 7 in since I was starting from scratch but worried some of my software might not work Everything went well except I couldn't find drivers for some things such as my wireless adapter so couldn't get on line. Called Linksys and they spent over an hour trying to get the driver in and finally did. That was the best part, finally getting on line and getting hit with a zillion MS updates. I have misplaced or lost some software. We moved here in March and I could not locate my Office disk, wireless mouse/keyboard software and a few other things, might have gotten lost in the move. I'm most concerned about Office 07. I paid for it. Dell says they can't help and I could try contacting MS and see if they would do anything. I haven't moved any of my files back yet. Otherwise, I feel like the computer runs better than when it was new. Things seem different, have to fool with fonts and views, but I'm amazed how effortlessly the machine runs. This computer always seemed to have a few 'glitches' but I was used to it. Now it seems so fast and smooth (of course there isn't much running on it yet.) I don't know how to thank everyone for all the support and help I received. You are the best friends anyone could ever ask for. I guess you can teach an old dog new tricks! Thanks from the bottom of my heart... Jane
...See More
Computer Q: All my bookmarks disappeared!
Q
Comments (7)
I did all of the above. While a couple of old sites came up in a search, most of them were still missing. The trouble is that AOL uses IE but also has its own system, which is different. I am able to pull up the IE favorites but not the AOL favorites (which is most of my bookmarked sites). Then I read through all of the tutorials in the AOL Help section that pertain to Favorites. It says that they now use a system that does not save your favorites on your computer. Here is the exact language: Determine if 'Only Store my Favorite Places on my Computer' Is Checked. If it is not checked, it means your Favorite Places are saved online. AOL appreciates your patience during times when popular features may temporarily be unavailable. The AOLÂ® System is sometimes very busy and may experience temporary issues that can lead to delays or slow response. Note: With AOLÂ® 8.0 and higher versions, your Favorite Places are now stored on AOLÂ® servers rather than on your computer. This allows you to access your Favorite Places from any location or computer that you use. For example, if you sign on as a guest on another computer, you will automatically have access to your Favorite Places. Or, if you buy a new computer, you won't have to worry about how to transfer your Favorite Places. I still can't find my Favorites :( I will have to contact AOL again and see if they're stored somewhere in their cybervault.
...See More
pfmastin
Original Author
17 years ago
last modified: 11 years ago
This is the result but I don't know what it means. Help? :)

Pam

File has already been analysed:
MD5: f1c69fd5009cd4219c8dca5df475d66b
First received: -
Date: 02.02.2009 12:23:40 (CET) [>43D]
Results: 0/39
Permalink: analisis/f576ee6d74f1376c954a6e66966905d1
zep516
17 years ago
last modified: 11 years ago
If that's the Virus Total Scan then there is nothing wrong, here is a bad scan it's actually from my sisters computer when it was infected so you can see if it were an issue Virus Total should have caught it, still concerned run Malwarebytes.

Bad scan below from virus total example:

C:\WINDOWS\system32\7LeXCtL7.exe ----- Below are the results from Virus Total.

Antivirus Version Last Update Result
AhnLab-V3 - - -
AntiVir - - TR/Spy.ZBot.fza
Authentium - - W32/FakeAV.EY
Avast - - Win32:Spyware-gen
AVG - - Clicker.TPX
BitDefender - - Trojan.Downloader.JLFE
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - Trojan.WinSpy.111
eSafe - - Win32.Zbot.fza
eTrust-Vet - - Win32/FakeAlert.KQ
Ewido - - -
F-Prot - - W32/FakeAV.EY
F-Secure - - Trojan-Spy.Win32.Zbot.fza
Fortinet - - W32/Zbot.FZA!tr.spy
GData - - Trojan.Downloader.JLFE
Ikarus - - Trojan-Spy.Win32.Zbot.fza
K7AntiVirus - - Trojan-Spy.Win32.Zbot.fza
Kaspersky - - Trojan-Spy.Win32.Zbot.fza
McAfee - - -
Microsoft - - TrojanDownloader:Win32/Popur.B
NOD32 - - Win32/TrojanClicker.Agent.NES
Norman - - W32/Zbot.BNO
Panda - - Trj/Sinowal.VVQ
PCTools - - Trojan-Spy.Zbot!sd6
Prevx1 - - Cloaked Malware
Rising - - Trojan.Spy.Win32.Zbot.fak
SecureWeb-Gateway - - Trojan.Spy.ZBot.fza
Sophos - - Troj/Dloadr-BXX
Sunbelt - - Trojan-Spy.Win32.Zbot.fza
Symantec - - -
TheHacker - - -
TrendMicro - - -
VBA32 - - -
ViRobot - - Trojan.Win32.Zbot.60928.F
VirusBuster - - -
Additional information
MD5: bef9d3070f9b71f4c44feff2b2b6ef6b
SHA1: 873c95b6060e334abc1457b98386bcdc05149929
SHA256: 7753603dcc99a4a4b1d4ad2aa9fe36118de7dbae1b6e1ff2c2b695650073817b
SHA512: 9a46147ed02d9006ce47cf34613df5d74363eea838cef0c49a6a64572ec99476761ed5cc6f8cea56a4756877a45722caa184aa867f91a2752c63a7248b1a3c6f
zep516
17 years ago
last modified: 11 years ago
Here are my results scanning the same file you did on my xp,

File lsass.exe received on 03.17.2009 07:25:22 (CET)
Current status: finished
Result: 0/39 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.17 -
AhnLab-V3 5.0.0.2 2009.03.16 -
AntiVir 7.9.0.116 2009.03.16 -
Authentium 5.1.0.4 2009.03.17 -
Avast 4.8.1335.0 2009.03.16 -
AVG 8.0.0.237 2009.03.16 -
BitDefender 7.2 2009.03.17 -
CAT-QuickHeal 10.00 2009.03.17 -
ClamAV 0.94.1 2009.03.17 -
Comodo 1060 2009.03.16 -
DrWeb 4.44.0.09170 2009.03.17 -
eSafe 7.0.17.0 2009.03.15 -
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.16 -
F-Secure 8.0.14470.0 2009.03.17 -
Fortinet 3.117.0.0 2009.03.17 -
GData 19 2009.03.17 -
Ikarus T3.1.1.45.0 2009.03.17 -
K7AntiVirus 7.10.673 2009.03.16 -
Kaspersky 7.0.0.125 2009.03.17 -
McAfee 5555 2009.03.16 -
McAfee+Artemis 5555 2009.03.16 -
McAfee-GW-Edition 6.7.6 2009.03.16 -
Microsoft 1.4405 2009.03.17 -
NOD32 3941 2009.03.17 -
Norman 6.00.06 2009.03.16 -
nProtect 2009.1.8.0 2009.03.17 -
Panda 10.0.0.10 2009.03.16 -
PCTools 4.4.2.0 2009.03.16 -
Prevx1 V2 2009.03.17 -
Rising 21.21.10.00 2009.03.17 -
Sophos 4.39.0 2009.03.17 -
Sunbelt 3.2.1858.2 2009.03.17 -
Symantec 1.4.4.12 2009.03.17 -
TheHacker 6.3.3.0.283 2009.03.16 -
TrendMicro 8.700.0.1004 2009.03.17 -
VBA32 3.12.10.1 2009.03.16 -
ViRobot 2009.3.17.1651 2009.03.17 -
VirusBuster 4.6.5.0 2009.03.16 -
Additional information
File size: 13312 bytes
MD5...: bf2466b3e18e970d8a976fb95fc1ca85
SHA1..: de5a73cbb5f51f64c53fb4277ef2c23e70db123f
SHA256: f7794b5d12dc5d820a162850f4388e2aa80426ad07cb221799cf941c682ab501
SHA512: c1f09ab3ad3b892f009270eb5325d801435ff2ffbf1354e66e333025634b707a
4cedf58a6b306efdddfcb1c010767983000d72dc5935240455f98f4490f551d4
ssdeep: 384:ggHUJZXmtGDWkzLWT4a8WfMptsN0BhgO49:338z4zRfMpy0BF4
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x14bd
timedatestamp.....: 0x48025186 (Sun Apr 13 18:31:34 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x10d0 0x1200 6.00 7d33d24893e1db0fa0ecbd7a8fa637bd
.data 0x3000 0x6c 0x200 0.20 86a789a893c60d5e207d053188cdc250
.rsrc 0x4000 0x1b30 0x1c00 7.15 54488850c25258396b2c9492c36b0bd5

( 5 imports )
> ADVAPI32.dll: FreeSid, CheckTokenMembership, AllocateAndInitializeSid, OpenThreadToken, ImpersonateSelf, RevertToSelf
> KERNEL32.dll: CloseHandle, GetCurrentThread, ExitThread, SetUnhandledExceptionFilter, SetErrorMode, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, RtlUnwind, InterlockedExchange, VirtualQuery
> ntdll.dll: NtSetInformationProcess, RtlInitUnicodeString, NtCreateEvent, NtOpenEvent, NtSetEvent, NtClose, NtRaiseHardError, RtlAdjustPrivilege, NtShutdownSystem, RtlUnhandledExceptionFilter
> LSASRV.dll: LsaISetupWasRun, LsapDsDebugInitialize, LsapAuOpenSam, LsapCheckBootMode, ServiceInit, LsapInitLsa, LsapDsInitializePromoteInterface, LsapDsInitializeDsStateInfo
> SAMSRV.dll: SamIInitialize, SampUsingDsData
zep516
17 years ago
last modified: 11 years ago
Your date on you scan is :

02.02.2009 12:23:40 (CET) [>43D] ?????
pfmastin
Original Author
17 years ago
last modified: 11 years ago
That's odd, zep...I just now did it and I've never heard of being able to do that before.

Let's be sure I did this right. I clicked on the link you gave me, clicked browse and then found the file under WINDOWS >>>>WINDOWS/system32/lsas.exe and clicked on it. It appeared in the blank space and then I clicked Send File. Was that the right thing to do?

Pam
zep516
17 years ago
last modified: 11 years ago
Yes it was so I don't know why, I think your worried to much about this file let it have access when it wants it's a legit Microsoft file running from the System32 folder, It's still a fine learning process though the things we did.

zep
pfmastin
Original Author
17 years ago
last modified: 11 years ago
Thanks zep! I'm sure you're right.
Pam
zep516
17 years ago
last modified: 11 years ago
Post a hijackthis log if you want. I'll look at it..

lsass.exe trying to contact my computer

Comments (10)

zep516

zep516

Related Discussions

pfmastin
Original Author

zep516

zep516

zep516

pfmastin
Original Author

zep516

pfmastin
Original Author

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

lsass.exe trying to contact my computer

Comments (10)

zep516

zep516

Related Discussions

pfmastinOriginal Author

zep516

zep516

zep516

pfmastinOriginal Author

zep516

pfmastinOriginal Author

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author