Posted 01 June 2008 - 06:35 PM
Lsass.exe is both a legitimate program and malware. It all depends on it being the legitimate file or a piece of malware.
There was an old exploit of it that was fixed with SP2 - so if you've got SP2 you're safe from the exploit.
The good copy of Lsass.exe (Local Security Authority Service) is located in C:\Windows\System32 As long as this hasn't been replaced by malware (not likely, but possible) it should be OK. If it's located in $NTServicePackUninstall or in ServicePackFiles it's likely OK - anywhere else and it's likely to be bad.
If you can get at it's properties, post the version, size, and date information so someone can compare it with their copy.
My XP SP3 info for it is:
Size: 13.0 KB (13,312 bytes)
Size on disk: 16.0 KB (16,384 bytes)
Created: Tuesday, February 28, 2006, 8:00:00 AM
Modified: Saturday, September 01, 2007, 5:20:56 AM
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able. - John
(my website: http://www.carrona.org/
)**If you need a more detailed explanation, please ask for it. I have the Knack
. ** If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.
<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.