Hello there guys,

Norton keeps asking me to permit or block lsass.exe and honestly I've no idea. It never asked me before. It seems harmless but you never know, right? What should I do?

Thanks in advance.

What sort of blocking? Can you provide the complete message? Also, does Norton provide a path for the file? If so, what is it?

Orange Blossom

Now I wish I had taken note of the whole message.

It's the regular Norton Program Control alert. Like this one: http://personalshopper.com/images/media/Norton-Permit.gif

The file is in the system32 folder. That's all I can remember.
I'll take note of the whole thing next time Norton pops up.

Thanks for replying so quickly.

Okay, so I take it that this was an alert that lsass.exe was trying to connect to the internet?

Can you check the Norton logs and see what information regarding the alerts is there? If it logs as well as Kerio or ZoneAlarm, you should see the file path of the file that was trying to connect as well as what it was trying to connect to, either an IP address or a domain name or something. If that information is there, can you post that please?

Orange Blossom

This is what I found on the logs:

Details: The user has created a rule to "block" communications.
Inbound UDP packet.
Local address,service is (0.0.0.0,500).
Remote address,service is (70.241.123.188,500).
Process name is "C:\WINDOWS\system32\lsass.exe".

Okay, according to the log entry, something was trying to come in to your computer from outside and connect to lsass.exe The file location, by the way, is the correct one - so unless you have a file infector on board, the file itself should be hunky-dorry.

lsass.exe is responsible for monitoring logging in and so forth. See here: http://www.neuber.com/taskmanager/process/lsass.exe.html
and here: http://www.liutilities.com/products/wintas...slibrary/lsass/ I see no reason why something from outside should be trying to send stuff to it unless you were doing windows updates, and I'm not sure even then as updates work through IE.

I looked up the remote IP address, and it appears to be SBC Internet Services trying to send stuff in. Do you subscribe to that internet service? Even if you do, it sounds fishy that it would be trying to communicate with lsass.exe unless you happen to be a primary computer on a network, but I'm not sure about that as I work with a stand-alone computer. Enter the IP address at this site: http://www.networksolutions.com/whois/ and you will see the full info. about the IP.

Orange Blossom

Duane,

The IP number appears to be either a user on the SBC Network or a backend server from SBC. That is unclear.

The last part of that number 500, appears to be port 500 which is known to be used with Remote login and Authentication for servers.

Do you know what a VPN is? Do you have a VPN or Remote Desktop setup on your machine. If so Norton may ask for your ok in order for an outside party to connect to you through Remote Desktop. If this is NOT something you have set up. You may have a valid security concern and would need to contact either, Your Service Provider, Symantec ( Norton Distributor), or Microsoft for further assistance and to determine the cause of these events which should also be stored in the windows event logs

I'm not a subscriber to that service. I also don't have a VPN nor a Remote Desktop setup.

I'm running all the anti bad stuff I got here (Norton, SpySweeper, AdAware, Mcafee Stinger, Spybot, Trojan Remover) and so far so good. Some of the scans haven't finished yet. I'll let you know if anything comes up.

Could this be something serious?

All the scans have finished now. All the minor things that were found have been taken care of. I hope Norton doesn't ask me about lsass.exe again.

Okay, this was probably internet static, as it were, or a port scan. This kind of thing happens all the time. For example, I've had a number of port scans from twtelecom.net As long as your firewall is blocking it, you should be fine.

Orange Blossom

lsass hasn't bothered me again so far and I hope it doesn't.

Thanks for the support. I appreciate it.

Your welcome. Don't freak out at the incoming traffic that Norton blocks or alerts you to. There is a lot of internet noise out there. As long as it's blocked you're fine. My basic rule of thumb is, if I'm not expecting it - block it. I can always change it if there is a problem.

Outbound traffic is a different matter, and I keep an eagle eye on that. Norton will also alert you to that. The XP firewall, incidentally, doesn't block any outgoing traffic which is why a third party firewall is better. If there is something trying to connect that I don't recognize at all, I put a total block on all internet traffic. I'll even pull modem line out of the phone jack. (I'm on dial-up). I'll scan like crazy, make sure everything's clean, then reconnect. If it's a program I recognize, I'll do some research first before allowing it to connect. I'll check out the IP address and so forth. Does it really need to connect? If not, it's blocked.

Here's a tutorial on firewalls: http://www.bleepingcomputer.com/tutorials/tutorial60.html

Orange Blossom