Lsass.exe Process--Disk Thrashing?

[John]

While monitoring (in Task Manager) the lsass.exe process, I noticed it's a
huge user of both disk reads and writes. I thought this was a
service/process related to licensing. What is it exactly and why does it
appear to thrash my HDD?

Thanks.

 

[Alex T. ~MVP Windows Shell/User~]

IT all depends.

http://www.liutilities.com/products/wintaskspro/processlibrary/lsass/

According to that site there. lsass.exe is a Windows process which controls
the local security and logon processes. But it is also a noted trojan and
downloader. So you might want to run some scans to make sure that is it not
the later and is the Windows Process running.

 

[Jon]

While monitoring (in Task Manager) the lsass.exe process, I noticed it's a
huge user of both disk reads and writes. I thought this was a
service/process related to licensing. What is it exactly and why does it
appear to thrash my HDD?

Thanks.

The legit version authenticates users eg if you run a program / script as
another user, which ordinarily would only be a few seconds. So if your is
not a virus, then you have a lot of authenticating going on.

 

[Dwarf]

Hi John,

This file, lsass.exe, is an essential part of the Windows operating system.
LSASS, the Local Security Authority Subsystem Service, is responsible for
helping Windows manage security and logins. It is normal for this process to
access the system on a regular basis, but excess access by this process is a
case for concern, particularly when accompanied by higher than normal CPU
useage. You should be able find the lsass.exe file in the following folder:
'C:\windows\system32'. Check this by opening 'Task Manager'. Select the
'Processes' tab. Click on 'Show processes from all users' (provide
administrative credentials when prompted). Scroll down the list until you
come to 'lsass.exe'. Check the 'CPU' useage for this process. Right click on
'lsass.exe' and select 'Properties' from the popup menu. In the 'General'
tab, check the location of this file. If it is different to that mentioned
above, then your system is infected with a variant of the SASSER malware and
you should scan your system with your anti-malware tools, allowing them to
fix any problems that they find. In severe cases, a reinstallation of your OS
may be required.
Dwarf