Lsass.exe Process--Disk Thrashing?

While monitoring (in Task Manager) the lsass.exe process, I noticed it's a
huge user of both disk reads and writes. I thought this was a
service/process related to licensing. What is it exactly and why does it
appear to thrash my HDD?

Thanks.

IT all depends.

http://www.liutilities.com/products/...library/lsass/

According to that site there. lsass.exe is a Windows process which controls
the local security and logon processes. But it is also a noted trojan and
downloader. So you might want to run some scans to make sure that is it not
the later and is the Windows Process running.

--
~Alex T~
..:MVP Windows Shell/User:.

"John" <> wrote in message
news:...
> While monitoring (in Task Manager) the lsass.exe process, I noticed it's a
> huge user of both disk reads and writes. I thought this was a
> service/process related to licensing. What is it exactly and why does it
> appear to thrash my HDD?
>
> Thanks.
>
>
>

"John" <> wrote in message
news:...
> While monitoring (in Task Manager) the lsass.exe process, I noticed it's a
> huge user of both disk reads and writes. I thought this was a
> service/process related to licensing. What is it exactly and why does it
> appear to thrash my HDD?
>
> Thanks.
>
>
>


The legit version authenticates users eg if you run a program / script as
another user, which ordinarily would only be a few seconds. So if your is
not a virus, then you have a lot of authenticating going on.

--
Jon

Hi John,

This file, lsass.exe, is an essential part of the Windows operating system.
LSASS, the Local Security Authority Subsystem Service, is responsible for
helping Windows manage security and logins. It is normal for this process to
access the system on a regular basis, but excess access by this process is a
case for concern, particularly when accompanied by higher than normal CPU
useage. You should be able find the lsass.exe file in the following folder:
'C:\windows\system32'. Check this by opening 'Task Manager'. Select the
'Processes' tab. Click on 'Show processes from all users' (provide
administrative credentials when prompted). Scroll down the list until you
come to 'lsass.exe'. Check the 'CPU' useage for this process. Right click on
'lsass.exe' and select 'Properties' from the popup menu. In the 'General'
tab, check the location of this file. If it is different to that mentioned
above, then your system is infected with a variant of the SASSER malware and
you should scan your system with your anti-malware tools, allowing them to
fix any problems that they find. In severe cases, a reinstallation of your OS
may be required.
Dwarf

"Alex T. ~MVP Windows Shell/User~" wrote:

> IT all depends.
>
> http://www.liutilities.com/products/...library/lsass/
>
> According to that site there. lsass.exe is a Windows process which controls
> the local security and logon processes. But it is also a noted trojan and
> downloader. So you might want to run some scans to make sure that is it not
> the later and is the Windows Process running.
>
> --
> ~Alex T~
> .:MVP Windows Shell/User:.
>
> "John" <> wrote in message
> news:...
> > While monitoring (in Task Manager) the lsass.exe process, I noticed it's a
> > huge user of both disk reads and writes. I thought this was a
> > service/process related to licensing. What is it exactly and why does it
> > appear to thrash my HDD?
> >
> > Thanks.
> >
> >
> >

Try disabling Windows Defender. I had the same Trashing issue and only
got it to stop by stopping Windows Defender. Control Panel - Security -
Windows Defender - Uncheck all the option in the Tools menu.

Ryan


--
ryhiggin
------------------------------------------------------------------------
ryhiggin's Profile: http://forums.techarena.in/members/ryhiggin.htm
View this thread: http://forums.techarena.in/vista-help/896148.htm

http://forums.techarena.in