lsass.exe

keith 1000 · 9th October 2007

hi guys.
its been a few months since i posted anything.
just wondering if you could help with a little problem. i have been downloading a few torrents from a site using azureus as my torrent provider, since this morning i have been getting a couple Norton pop-ups. saying that is has caught an intrusion trying to get into my cpu. the line it caught was
C:\WINDOWS\system32\lsass.exe and its giving me the option to block or pemit. well i did a little research on the net and the responce i've got is about 50\50. that says to either permit or block.
i havnt got it anymore in the past couple hours but should i keep blocking it.

Master Green · 9th October 2007

Hi,
To the best of my knowledge, what Norton is showing as for the path is the correct path "C:/Windows/System32/Lsass.exe"
It is suppose to serve as a Security Authentication to validate the user Logon...In further search of more information, any other location would indicate a trojan/worm and I do believe will show as "llsass and not Lsass". Personally, I would boot to safe mode after you make sure your virus protection has all it's updates and run it in safe mode for your own personal satisfaction...For FYI purposes, when you Google "lsass.exe" the majority of information is about it being a trojan/worm, etc...When I looked it up in Windows Startup and Task List, it mentions it but also explains the correct path as I mentioned and to be feel safe about it, to run your virus scan in safe mode as I mentioned...Good Luck and keep us posted...