What the lsass.exe? Searching for Windows Processes

Ever wonder what all of those mysteriously-named Windows "processes" are doing, and how they got loaded on your computer in the first place? Use the helpful ProcessLibrary.com to find out.

Control-ALT-Delete used to perform a very simple, but (sadly) vital function: rebooting your windows computer. In recent versions of Windows, pressing Control-ALT-Delete now brings up the Windows Task Manager, which offers alternatives to handling misbehaving software without the brute force approach of a hard reboot.

The Task Manager has four views: Applications, Processes, Performance and Networking. The Applications view shows you currently running programs. Use the "End Task" button on this view to kill a program that isn't working as expected—or to get rid of a "mousetrapped" browser that's repeatedly displaying an offensive web site.

The Performance and Networking views offer interesting statistics, but aren't really useful unless you're a serious Windows geek.

It's the Processes view that offers the most insight into what's going on with your computer. Unfortunately, it also displays information in maddeningly cryptic fashion, showing "Image Name," "User Name," "CPU" and "Usage" details. Two of these offer the most meaningful information: Image Name is the name of a process that's currently running in memory, and CPU shows you how much capacity of your computer's central processing unit is being consumed by the process.

If your computer is sluggish, the processes view will tell you which process is hogging your system resources. Wse the "End Process" button to kill it. Be careful, though—killing some processes could lock up your computer and potentially result in loss of data.

Problem is, it's almost impossible to determine what most processes are from their image names. I'm convinced that the people who write Windows processes are highly trained in the art of obfuscation. Some of the more common processes include lsass.exe, alg.exe, svchost.exe, csrss.exe and smss.exe. And there's no "properties" information to tell you anything about what these things are doing or how they got started in the first place.

Enter ProcessLibrary.com. This searchable database makes it easy to find information about even the most obscure process running on your computer. Take lsass.exe, for example. If your computer uses a current version of Windows XP, this process is almost certainly running. What is it?

Local Security Authority Service. "This is a system process of the Microsoft Windows security mechanisms. It specifically deals with local security and login policies." In addition to this description, ProcessLibrary.com also tells you the author of the process, and whether it's associated with the operating system or a particular piece of software.

Even more importantly, it also indicates whether the process is something nasty, like a virus, Trojan or spyware, and assigns the process a security risk from zero to five.

ProcessLibrary.com isn't an altruistic effort—it's the work of a company called UniBlue that sells a program called WinTasks Pro that's designed, surprise surprise, to help you deal with or eliminate nasty processes. Nonetheless, the amount and quality of information offered on the site makes it a worthwhile resource.

ProcessLibrary also has a DLL Search that's useful for decoding cryptic error messages.

Other sources for this type of information include Sysinfo.org's Startup Applications List and Task List Programs from Answers That Work. Google's specialized Microsoft search is also another great resource for finding information about startup processes, from these sites and many others.
Source
 
More about lsass or lsass.exe
(Process Name: Local Security Authority Service)

Description:
lsass.exe is a system process of the Microsoft Windows security mechanisms. It specifically deals with local security and login policies. Note: lsass.exe also relates to the Windang.worm, irc.ratsou.b, Webus.B, MyDoom.L, Randex.AR, Nimos.worm which spread via floppy disk drives, mass-mailing and peer-to-peer sharing. Please review file path for clarification of this. sourcehttp://www.neuber.com/taskmanager/process/lsass.exe.html
The lsass.exe which is from Microsoft is located at ~\windows\System32\lsass.exe . there's a few viruses that have been found to run as lsass.exe to hide from you.
W32.HLLW.Lovgate.C@mm
W32.Mydoom.L@mm
W32.Nimos.Worm
W32.Sasser.E.Worm (Lsasss.exe) sourcehttp://www.iamnotageek.com/a/lsass.exe.php
lsass.exe is a Windows System File and should be in a system directory. If it is then this application is safe.

Finding lsass in the windows registry
In the registry the ,executable Files to be Lauched by Winlogon (Windows NT/2000/XP) is given by the follwing registry field.This setting specifies a list of executable files to be run by Winlogon in the system context when Windows starts.

System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Value Name: System
Data Type: REG_SZ (String Value)
Value Data: (default = lsass.exe)

important note regarding lsass.exe
You cannot end this process from Task Manager.
- This is the local security authentication server, and it generates the process responsible for authenticating users for the Winlogon service.
-This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell.
-Other processes that the user initiates inherit this token. sourcehttp://support.microsoft.com/default.aspx?scid=kb;en-us;263201&sd=tech
 
well..as lsass thing has been put up, i just want to know abt this..
my friend has got winxp NAV 2003 and ZA. Sometimes when she is online, an err msg comes like the system is going to shut down within this much mins.. which i think is the behaviour of the sasser(or som other) virus.. when scanned nothin came.. but after tat when she again went online nothin happened.. wat is the problem actually..
 
@Blue, that is called blaster virus...

There is a process called csrss.exe, it u try to end that process then also this blaster worm strikes...
Note: csrss.exe is also process which is registered as the W32.Netsky.AB@mm worm, the W32.Webus Trojan, Win32.Ladex.a and more. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open it’s hostile attachment. The worm has it’s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.
 
Last edited by a moderator:
@blue : use "shutdown -a "command to avoid getting shudown , use sophos anti-blaster and anti-sasser tools to get rid of the virus , using a firewall would also render the virus useless as it connects to some port .
 
Back
Top