Computing.Net > Forums > Security and Virus > Lsass- CPUuseage jump

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Lsass- CPUuseage jump

Reply to Message Icon

Original Message
Name: mang109
Date: March 19, 2008 at 07:58:25 Pacific
Subject: Lsass- CPUuseage jump
OS: xp-sp2
CPU/Ram: 2ghz,3gb
Manufacturer/Model: Mesh elite
Comment:

My PC started making its traditional " Im working really really hard" noise- so I opened up taskmanager and saw Lsass.exe was using 25% of my CPU. I knew Lsass was a normal process- but that wasn't normal so I pulled out the network cable , and restarted.

I am now on a different machine, and Ive looked up all about Lsass - by the looks of it many Trojans use it .

I have scanned and rescanned ( on the infected one) with 4 different scanners- I DEFINITELY do not have the sasser worm

and no other warning has come up.

Is there anyway to tell IF and WHAT I have ?

any other free downloadable scanner links would help, I have tried many - but many more will not hurt.

thanks


Report Offensive Message For Removal


Response Number 1
Name: Jeruvy
Date: March 19, 2008 at 17:04:24 Pacific
Reply:

Well I don't know how comfortable you are at reading memory locations and referencing them to threads and handles, but Process Explorer may have the explanation you need. Download from Microsoft directly.

Of course try an online scan. I like nanoscan by Panda, but any will do.

Given the description of your issue, it's also possible your PC is just getting old and protesting a lot :)

Submit the lsass.exe to virustotal.com and get 32 anti-virus programs to check if it's legit or not.

J.
j e r u v y a t y a h o o d o t c o m


Report Offensive Follow Up For Removal







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home



Results for: Lsass- CPUuseage jump

W32.apolre
    Summary: hi carrol, if the worm is aplore and not apolre, here's some info for you: This worm combines a VBS mass-mailing routine and includes an IRC bot which may allow an attacker to gain remote access to th...
www.computing.net/answers/security/w32apolre/2848.html

virus alert!!!!!
    Summary: nortons alert on swen it sounds bad becarefull What is W32.Swen.A@mm and how does it affect me? W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spre...
www.computing.net/answers/security/virus-alert/6536.html

jabuck please help
    Summary: StartupList report, 07-01-07, 20:53:40 StartupList version: 1.52.2 Started from : C:\HijackThis\HijackThis.EXE Detected: Windows XP (WinNT 5.01.2600) Detected: Internet Explorer v6.00 (6.00.2600.0000...
www.computing.net/answers/security/jabuck-please-help/20157.html








Which MP3 player do you have?

iPod/iPhone
Zune
Something Else
None


View Results

Poll Finishes Today.
Discuss in The Lounge
Poll History






Data Recovery Software