What is this file?

Recently I checked out ZA's programs and found one that said LSA Shell (Export V...)

The file name is: C:\WINDOWS\System32\lsass.exe
Version 5.1.2600.2180 (xpsp_sp2_rtm.040803_2158)

I've temporarily blocked it. Any information would be appreciated.

 

Hi James,

Its a legitimate Windows process:
http://www.liutilities.com/products/wintaskspro/processlibrary/lsass/ and also look here http://www.answersthatwork.com/Tasklist_pages/tasklist_i.htm : BUT note that the legit process starts with lower case L which looks like an eye. If its not an lower case L - that may be malware. The path you posted is correct - if its among the L's.

Otherwise if its the OS process, can't think of a reason why Net access should be allowed, so I would keep blocking it. You certainly shouldn't give it Server Rights which keeps a port open.

Regards - Charles

 

Thanks, Charles. That opens up a question regarding server rights. For instance, Generic Host Process for Win 32 SErvices wants to accept connections from the internet. Do I deny it server rights? If I put it on ask (Zone Alarm) it bugs me throughout the day.

In fact, do you allow server rights to anything? In fact, I'm allowing access to the above but not server rights.

 

Hi James,

Exactly the right response

The only app(s) that I'm aware of that need server rights are IM chat apps. There may be others, but I'm not running any that need it.

Regards - Charles

 

Thanks, Charles.