Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Extended Hdd Activity - Lsass.exe File


  • Please log in to reply
17 replies to this topic

#1 Kiwee

Kiwee

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 27 September 2007 - 08:02 PM

When I turn on my PC for some 10 minutes or more the HDD goes continuously. When I look in Task Manager under Processes the I/O Reads for lsass.exe is over 450,000. That is the only file that looks unusual. I've done a virus scan, defrag & run Ad-Aware but am now at a loss for what to do next. While the HDD is cranking away the PC runs very slowly.

Any help appreciated !
Mike

BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:06:59 AM

Posted 27 September 2007 - 08:27 PM

Can be a virus or a needed process. Read this thread
http://www.bleepingcomputer.com
Mark
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 28 September 2007 - 04:50 AM

Unfortunately I feel more confused now. Do you think this is a problem, or shall I just leave it as is ? It never used to do this though.

Thanks

#4 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:59 PM

Posted 28 September 2007 - 04:53 AM

Do a search on your hard drive for any lsass.exe files. Post back the results.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#5 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 28 September 2007 - 05:02 AM

Thanks, heres the search results, 2 items found:

lsass C:\i386
lsass C:\WINDOWS\system32

Cheers
Mike

#6 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:59 PM

Posted 28 September 2007 - 05:13 AM

I think those locations are okay. So, while the computer is running slow what is using the most CPU in the Task Manager? Is it lsass.exe?
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#7 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 28 September 2007 - 05:23 AM

lsass fluctuates around 20%, system idle process is around 65%

#8 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 28 September 2007 - 05:39 AM

Also ..... Mcshield.exe is another that fluctuates around 20% at the same time that all the activity is going on, maybe it is related. In a reboot 15 minutes ago lsass.exe I/O reads is sitting at 653,039, all is now quite and Mcshield & lsass CPU time are now both at 00. System Idle Process 99%

This only happens when the computer is first fired up, after 10 or 15 minutes everything goes quite and things run normally. I understand that Mcshield relates to McAfee, so maybe it something to do with that ?

Thanks
Mike

#9 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:59 PM

Posted 28 September 2007 - 05:45 AM

You might want to have a read through this thread and see if any of that applies to you.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#10 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 28 September 2007 - 06:33 AM

Sound very much the same. I do have another computer linked via a LAN connection however can't remember transferring encrypted files between them but may well have done at some stage ! I setup another user that wasn't an administrator and when I logged on as that there was 'minimal' HDD activity - interesting. Anyway I very much at a loss as to what to do now though ?

Thanks
Mike

#11 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:59 AM

Posted 28 September 2007 - 09:21 AM

I would suspect that this is an automatic scan that McAfee is performing when you start up (since it ends after 10 minutes or so). The excessive lsass (.exe activity seems to indicate a problem tho' - and it could be related to the McAfee.

I would suggest using another set of protection tools (and removing the McAfee) - but that's my personal opinion. We can suggest free tools that will do (IMO) a better job of protecting with far less problems than the McAfee will cause.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#12 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 28 September 2007 - 03:53 PM

John, sounds good to me. What would your suggestions be ?

Regards
Mike

#13 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:59 AM

Posted 29 September 2007 - 07:28 PM

Personally, I use AVG Free (from here: http://free.grisoft.com/doc/5390/us/frt/0 ), Windows Defender (comes with Vista) and the Windows Firewall (with my own custom rules setup).

I would download the AVG Free to your desktop, then uninstall the McAfee, reboot. Then immediately install the AVG Free, ensure the Windows Defender and the Windows Firewall are operational.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#14 Kiwee

Kiwee
  • Topic Starter

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Zealand
  • Local time:10:59 PM

Posted 29 September 2007 - 11:04 PM

Have removed McAfee, however AVG fails to install with the following error:

Local machine: installation failed
Installation:
Error: Action failed for file avg7core.sys: starting service....
Insufficient system resources exist to complete the requested service. (1450)

#15 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:06:59 AM

Posted 30 September 2007 - 07:46 AM

Exactly how did you remove McAfee?
Mark
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users