LSA Shell

[inkleputDEL]

Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware. Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).


JimL

 

[nathanfurry]

Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware.  Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).

JimL

Hello Jim,

The LSA Shell in short is responsible for validating users for both
local and remote logins. This is the reason why it is acting as a
server - due to the remote logins that LSA can do.
More information about the LSA Shell can be found at:
http://www.outpostfirewall.com/forum/showthread.php?t=2306

As for the Sasser Virus, this is usually only found if it is LSA Shell
(Export Version).
More info on that can be found here:
http://forums.techguy.org/malware-removal-hijackthis-logs/400084-lsa-shell-export-version.html

If you do not use the Remote Login Feature in the LSA shell, it would
be a good idea to block it with your firewall for security reasons.

Hope this helps,

Nathan

 

[nathanfurry]

Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware.  Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).

JimL

Hello Jim,

In Short the LSA Shell is responsible for validating users for both
local and remote logins. This means that it will try to gain access to
the internet and act as a sever for the Remote Login Feature.
More information can be found at:
http://www.outpostfirewall.com/forum/showthread.php?t=2306

However, If you have LSA Shell (Export Version) then you may have some
trouble on your hands.
Look here if you think this matches your situation:
http://forums.techguy.org/malware-removal-hijackthis-logs/400084-lsa-shell-export-version.html

If it doesn't then all is fine. It would be advised to block the LSA
Shell in your firewall for security reasons if your not using its
remote login feature.

Hope this Helps,

Nathan.

 

[nathanfurry]

Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware.  Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).

JimL

Sorry that I Posted this Twice. Please Disregard the Second Post.

Nathan