lsass.exe ??

MilesAhead · Aug 29, 2008

Hmmmm I seem to be at a loss!! If I remove or disable one item that touches all the files on my drive then some other piece of software picks up the ball and does the same thing. Now lsass.exe often decides to check every registry setting and file on my system. Sometimes it just runs on for 1/2 an hour!! Virus scans show nothing. I'm lost!! :cry:

I'm starting to understand why some people don't want to move from XP!
It is really becoming annoying to use this OS!!

Brink · Aug 29, 2008

Hi MilesAhead,

This will help explain more about lsass.exe. It is a pretty important system file, but it could also be a Trojan Virus if it is not in the C:\Windows\System32 folder.

Local Security Authority Subsystem Service - Wikipedia, the free encyclopedia

Hope this helps,
Shawn

skunksmash · Aug 29, 2008

Hi MilesAhead,

.......What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am? - Ask Leo!

don't know if this will help in any way..??

MilesAhead · Aug 30, 2008

Thanks for the replies. I never got the shutdown message until I tried to autokill lsass.exe. So far it seems like it's just making my HD run on, but I suppose it could be looking through all my files. It feels more like Vista running on than something malicious.

For one thing, it is in c:\windows\system32 and no virus scanners have picked up on it. Since this Sasser thing has been around since at least 2004 I find it hard to believe it wouldn't turn it up. But who knows?

johngalt · Aug 30, 2008

No, if your system shutdown when you killed it, that is the right one, owing to its location as well.

MilesAhead · Aug 30, 2008

johngalt said:
No, if your system shutdown when you killed it, that is the right one, owing to its location as well.

That's a relief but I'm wondering why there seems to be 10% unlucky people who have
this thing run on? When I google I see stuff from 2004 with no solution. If the guy
doesn't have the worm, the thread just trails off. I know everyone's drives don't just glow full on for 1/2 hour every day!! Can't be! There's got to be a work-around.

The more I search the more I see zero reports of this thing being made to go away.
Even reports of guys with 5 XP machines, 4 without the HD run on due to lsass.exe and one with. No clue what the difference is. Really bizarre.

MilesAhead · Aug 30, 2008

More info. My XP machine has lsass.exe and explorer.exe doing their thing checking whatever they check, but the disk access LED doesn't flicker. I saw a post similar to this about Vista. Seems for some reason it actually sends each file read write create to the disk hardware instead of doing any caching. There's got to be a fix for this someplace!

Maybe a driver fix?

MilesAhead · Sep 1, 2008

I think I may have finally hit pay dirt!
It seemed like lsass.exe was running my HD but in actuality
it was svhost.exe, which launches services. Similar hits pop
up in Google as far back as 2004 where some guys have HD
run on but most don't. My new theory is that it's due to the
fact that the desktops in question are Media Center PCs.

These run the 2 services Function Discovery Provider Host and
Function Discovery Resource Publication which publishes
multimedia resources on the network. I dsiabled both of these
and now when svhost.exe runs checking files, it checks a bunch
of .dlls and stuff in the system folders, but it doesn't read my .avi
and .mp3 files. So the HD runs only for a couple of minutes instead
of 20. Plus it's not totally pegged out so you can actually say, load
a browser while this is going on!!

Keeping my fingers crossed!!

:cool:

Brink · Sep 1, 2008

MilesAhead,

Thank you for posting your results back.

Shawn

Everlong · Sep 1, 2008

MilesAhead said:
I think I may have finally hit pay dirt!
It seemed like lsass.exe was running my HD but in actuality
it was svhost.exe, which launches services. Similar hits pop
up in Google as far back as 2004 where some guys have HD
run on but most don't. My new theory is that it's due to the
fact that the desktops in question are Media Center PCs.

These run the 2 services Function Discovery Provider Host and
Function Discovery Resource Publication which publishes
multimedia resources on the network. I dsiabled both of these
and now when svhost.exe runs checking files, it checks a bunch
of .dlls and stuff in the system folders, but it doesn't read my .avi
and .mp3 files. So the HD runs only for a couple of minutes instead
of 20. Plus it's not totally pegged out so you can actually say, load
a browser while this is going on!!

Keeping my fingers crossed!!

Thanks, just realised after reading this thread that I have the same problem as well. I've disabled them two services you mentioned, and will see if it makes a difference when I restart my PC as I get a slow down when I turn it on and things take a few mins to load.

MilesAhead · Sep 2, 2008

Brink said:
MilesAhead,

Thank you for posting your results back.

Shawn

Sure thing. So far so good. HD seems to be acting normally or at least
acceptably. I made a hard copy with the state of all my services in the
hope that this setup will be a keeper.

MilesAhead · Sep 8, 2008

Thanks, just realised after reading this thread that I have the same problem as well. I've disabled them two services you mentioned, and will see if it makes a difference when I restart my PC as I get a slow down when I turn it on and things take a few mins to load.

Hope it works. This has been an ongoing struggle since I bought this machine. Seems to be a lot of interlocking overlapping file indexing and publishing stuff going on, esp if you have a Media Center type of PC. I don't know if I'll ever find them all.

I like HP Media Center PCs because of good bang for the buck but unless they come up with an easier way to disable the multimedia bloat I might have to find another way of PCin'.

lsass.exe ??

Eclectician

My Computer

My Computers

im coming for cake

My Computer

Eclectician

My Computer

Antidisestablishmentarianist

My Computers

Eclectician

My Computer

Eclectician

My Computer

Eclectician

My Computer

My Computers

To xor or not to xor

My Computer

Eclectician

My Computer

Eclectician

My Computer