LSASS.EXE is permanently accessing the Hard Drive

[Guest]

Just to give a brief background of my PC: running Windows XP SP2 on a single
HDD spit into 2 partitions, one of 10GB the other 223GB.

Only recently I have noticed that the lsass.exe scurity program is
permanently accessing my drive. I have a HDD monitor installed however it
doesn't show any files being accessed on either of the partitions. The only
way to confirm that it is lsass.exe accessing the drive is by monitoring the
I/O Read Bytes in the Task Manager.

I can't begin to describe how irritating it is to have the HDD flashing once
per second and the usual grind once per second all the time while I use the
PC. I'm not exagerrating either, it's literally once per second for all the
time the PC is switched on, regardless of whether it's idle or running other
software!

The process cannot be shut down for obvious security reasons, but what can
be done to stop it accessing the drive all the time?

Thanks in advance

 

[Nomen Nescio]

When you get an answer, let the thousands of other people who's computers
are doing the same thing know. The question's been asked numerous times,
nobody has offered a real solution, not even Microsoft. Just did a clean
install of the OS and it started the every-second disc i/o nonsense right
from the first boot. No network activity, netwrok card driver wasn't even
installed yet.

 

[Guest]

When you get an answer, let the thousands of other people who's computers
are doing the same thing know. The question's been asked numerous times,
nobody has offered a real solution, not even Microsoft. Just did a clean
install of the OS and it started the every-second disc i/o nonsense right
from the first boot. No network activity, netwrok card driver wasn't even
installed yet.

So far I've only found one forum thread describing the same problem (
http://www.nvnews.net/vbulletin/showthread.php?t=16090 )so I can't tell just
how widespread it is yet. But as ever, the more something is discussed the
sooner it gets fixed

My major concern is that it's shortening the MTBF on my drive, I wouldn't
want to lose the whole thing just because some errant MS program insists on
playing up.

 

[Jim]

Just to give a brief background of my PC: running Windows XP SP2 on a
single
HDD spit into 2 partitions, one of 10GB the other 223GB.

Only recently I have noticed that the lsass.exe scurity program is
permanently accessing my drive. I have a HDD monitor installed however it
doesn't show any files being accessed on either of the partitions. The
only
way to confirm that it is lsass.exe accessing the drive is by monitoring
the
I/O Read Bytes in the Task Manager.

I can't begin to describe how irritating it is to have the HDD flashing
once
per second and the usual grind once per second all the time while I use
the
PC. I'm not exagerrating either, it's literally once per second for all
the
time the PC is switched on, regardless of whether it's idle or running
other
software!

The process cannot be shut down for obvious security reasons, but what can
be done to stop it accessing the drive all the time?

Thanks in advance

Lsass.exe is the name of a valid XP program which is part of local security.
Lsass.exe is also the name of one of the variants of the Sasser worm, and
this particular program acts like yours.

Thus, you have been infected.. My advice is to get David Lipman's Multi_AV
package. He follows the virus newsgroups (which is where you should have
posted).

Jim

 

[Nomen Nescio]

Lsass.exe is the name of a valid XP program which is part of local security.
Lsass.exe is also the name of one of the variants of the Sasser worm, and
this particular program acts like yours.

Thus, you have been infected.. My advice is to get David Lipman's Multi_AV
package. He follows the virus newsgroups (which is where you should have
posted).

This advice has proven over and over to not be the solution to the problem.
I did a virgin install of XP on a brand new hard disc, using a legitimate
copy of XP, no network card connected, plugged in, etc. On the first real
boot into the OS from the completed install, the hard disc was behaving as
the OP describes.

 

[witan]

Just to give a brief background of my PC: running Windows XP SP2 on a single
HDD spit into 2 partitions, one of 10GB the other 223GB.

[snip]

An observation, not directly related to your problem: Whether you
"spit" or "split", why such a small "10GB" partition? As an
experienced user (though not an "expert") I suggest you should
increase the partition (for Windows and your programs), at the
earliest available opportunity, to something like 40GB.
Regards
witan

 

[Guest]

Just to give a brief background of my PC: running Windows XP SP2 on a single
HDD spit into 2 partitions, one of 10GB the other 223GB.

[snip]

An observation, not directly related to your problem: Whether you
"spit" or "split", why such a small "10GB" partition? As an
experienced user (though not an "expert") I suggest you should
increase the partition (for Windows and your programs), at the
earliest available opportunity, to something like 40GB.
Regards
witan

Replying to both the new posts:

Firstly, I do hope it's not the Sasser worm, or I have to let Symantec know
that NOrton AV isn't working properly!

Secondly, the reason for a small 10gb partition is because I tend to only
keep Windows and essential programs on it (VGA drivers, HDD monitor etc).
It's a force of habit I guess, have always done so since I've partitioned
drives really

 

[Jim]

It is still the name of a valid XP program, but it certainly does not need
to access the internet.
I have also installed XP several times and bought several new ones. Not a
single one ever displayed this problem.

Lsass.exe is not running on this laptop at this time. It is definitely
present in \windows\system32 (and nowhere else).

Jim

 

[Jim]

Just to give a brief background of my PC: running Windows XP SP2 on a
single
HDD spit into 2 partitions, one of 10GB the other 223GB.

[snip]

An observation, not directly related to your problem: Whether you
"spit" or "split", why such a small "10GB" partition? As an
experienced user (though not an "expert") I suggest you should
increase the partition (for Windows and your programs), at the
earliest available opportunity, to something like 40GB.
Regards
witan

Replying to both the new posts:

Firstly, I do hope it's not the Sasser worm, or I have to let Symantec
know
that NOrton AV isn't working properly!

Secondly, the reason for a small 10gb partition is because I tend to only
keep Windows and essential programs on it (VGA drivers, HDD monitor etc).
It's a force of habit I guess, have always done so since I've partitioned
drives really

There seems to be a new version around. I saw references to this new
version dating to 2007. The previous version existed around 2004, and the
loophole that allowed it was fixed then.

With reference to your partitioning, XP on this computer would have a hard
time existing on just 10GB.

Jim

 

[Guest]

On Mar 1, 2:21 am, Kev Ruane <Kev (e-mail address removed)>
wrote:
Just to give a brief background of my PC: running Windows XP SP2 on a
single
HDD spit into 2 partitions, one of 10GB the other 223GB.
[snip]

An observation, not directly related to your problem: Whether you
"spit" or "split", why such a small "10GB" partition? As an
experienced user (though not an "expert") I suggest you should
increase the partition (for Windows and your programs), at the
earliest available opportunity, to something like 40GB.
Regards
witan

Replying to both the new posts:

Firstly, I do hope it's not the Sasser worm, or I have to let Symantec
know
that NOrton AV isn't working properly!

Secondly, the reason for a small 10gb partition is because I tend to only
keep Windows and essential programs on it (VGA drivers, HDD monitor etc).
It's a force of habit I guess, have always done so since I've partitioned
drives really

There seems to be a new version around. I saw references to this new
version dating to 2007. The previous version existed around 2004, and the
loophole that allowed it was fixed then.

With reference to your partitioning, XP on this computer would have a hard
time existing on just 10GB.

Jim

Going back to the original discussion: the only other XP PC I am using at
the moment is at work. Without going into too much detail, it's on a military
network so no over-the-counter type AV programs, and all logins are verrrry
secure

I notice that lsass on that machine stays pretty much static and does not
increase in I/O byte size at all, contrary to the one on my home machine. As
a tech-noob, is this a very small memory leak that's causing my HD usage?

 

[Guest]

So far I've only found one forum thread describing the same problem (
http://www.nvnews.net/vbulletin/showthread.php?t=16090 )so I can't tell just
how widespread it is yet. But as ever, the more something is discussed the
sooner it gets fixed

My major concern is that it's shortening the MTBF on my drive, I wouldn't
want to lose the whole thing just because some errant MS program insists on
playing up.

Actually, I've seen several posts about this. Annoyances.org has a huge
thread about it, but nothing since last year. There's another thread on this
forum about the same thing, I replied earlier tonight to. I'm convinced this
is one of those problems that is just getting ignored because it isn't
causing any real trouble other than a blinking light and shorter HD life. I
had this problem on my older computer, but took care of that by disabling
indexing. This machine has indexing turned off, yet still has the problem.
I've tried fresh install, and even using an image of my old HD with XP sp1,
and that still blinks with this hardware.

I have an amd 5200 athlon x2 with Asus Msn4-sli, two evga GeForce 7600 GT
Video cards, WD250gb SATA II and WD500GB SATA II and 2 GB ram. It should not
need to access the HD's.