lsass.exe takes a lot of CPU

[Guest]

On unpredictable moments lsass.exe uses a lot of CPU on my Windows XP Pro SP2.
I have all updates installed and a virus scan did not reveal any viruses or
malware. The process can't be killed, because this shuts the computer down
(as the sasser worm does).

Inspecting the threads the program runs, it looks like it is always the same
action that makes lsass.exe skyrocket in cpu usage: a thread with the name
ntdll.dll!RtlAllocateHeap. When i kill this thread only, the lsass process
runs fine and CPU usage cools down.

See http://www.flickr.com/photos/10019716@N06/787972601/ for a screenshot of
the process properties in processexplorer

Does this sound familiar to anyone?

 

[Guest]

On unpredictable moments lsass.exe uses a lot of CPU on my Windows XP Pro SP2.
I have all updates installed and a virus scan did not reveal any viruses or
malware. The process can't be killed, because this shuts the computer down
(as the sasser worm does).

Inspecting the threads the program runs, it looks like it is always the same
action that makes lsass.exe skyrocket in cpu usage: a thread with the name
ntdll.dll!RtlAllocateHeap. When i kill this thread only, the lsass process
runs fine and CPU usage cools down.

See http://www.flickr.com/photos/10019716@N06/787972601/ for a screenshot of
the process properties in processexplorer

Does this sound familiar to anyone?

First try to scan from another vendor(s) with on-line scanner.
Turn the windows Auto Update OFF and see if the issue will resolve.
What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp
W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

http://www.microsoft.com/downloads/...5D-DB0B-40F8-9A2E-DE93CBB5CB3A&displaylang=en
Download these tools to see the running processes in real-time and you
can search them to make sure they are Legit.
"Process Explorer for Windows v10.21"
http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx
"AutoRuns for Windows v8.61 By Mark Russinovich and Bryce Cogswell"
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx
HTH.
nass