Help with a process that is using WAY to much memory

oly884 · 09-03-2004, 01:46 PM

I've got WIN XP with SP1. Now, I just upgraded my memory, but there is a process LSASS.EXE that is sucking up 141,568 KB of memory. That's quite a bit, especially considering it never use to do this before. I've checked microsoft's help center thing (that really helped

) and I've googled it and can't come up with a really good answer as to why it's using so much memory. Any help will be much appriciated.

This ad is not displayed to registered members.
Register your free account today and become a member on Yotatech!

tulsa_97SR5 · 09-03-2004, 03:36 PM

Not sure what that process is, but you could always just try killing it & see if your PC crashes. Just checked my wifes XP machine, and whatever it is, she has it too. Only using 1,200 k on hers though. Hopefully someone else will know what it really is.

***Corey*** · 09-03-2004, 04:55 PM

Mine too is using 1,236.

You may have a virus.
http://www.iamnotageek.com/a/119-p1.php

Quote:

The lsass.exe which is from Microsoft is located in the c:\windows\System32 folder. there's a few viruses that have been found to run as lsass to hide from you.

Update your virus DATs and do a scan.

oly884 · 09-03-2004, 07:36 PM

Ok, so mcafee showed no sign of an infection. I restarted my computor, and now explorer is running at 83,772 KB and LSASS is running at 36,588 KB. Something is going on here and I know it isn't right. I can't find any thing on the net as to the cause of this. Any other suggestions?

***Corey*** · 09-03-2004, 07:42 PM

26,964 for my Exploder shell.
That is weird what is going on.

Sorry I do not have an answer.

calg3 · 09-03-2004, 07:55 PM

I found this on the web:

Today I'm going to explain to you guys what lsass is.

What is it?
Local Security Authentication Server

What does it do?
It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.

You will not be able to end this through task manager!
If yours is using that much memory, I would be concerned about a virus. My Win XP PC is using 00 for lsass.exe I use Zone Alarm, AdAware, McAfee VirusScan 7.1 and MS Firewall and don't have it running. I also remove MS File and Printer Sharing. Good luck.

MvCrash · 09-04-2004, 05:14 AM

Greetings,
Sounds like the "Sasser" worm might be your problem. Go to your virus scanner support and download the instructions on removal. There is a tool I believe. Then boot into safe mode without net support (no authentication) and have at it.
My opinion, take your valuables off, repartition, reformat, reinstall.

FYI...http://securityresponse.symantec.com...oval.tool.html

MV

**Yoda** · 09-04-2004, 10:05 AM

My lsass is 1,480 k

**Yoda** · 09-04-2004, 11:15 AM

This inspired me to run a scan on my computer. Had a trojan horse lurking in one of my son's folders. McAffee took it out.

He hasn't used my computer in months, and previous scans had not shown it!

09-03-2004, 03:36 PM	#2 (permalink)
tulsa_97SR5 Contributing Member Join Date: Feb 2004 Location: tulsa, OK Posts: 1,329	Not sure what that process is, but you could always just try killing it & see if your PC crashes. Just checked my wifes XP machine, and whatever it is, she has it too. Only using 1,200 k on hers though. Hopefully someone else will know what it really is. __________________ Brian 85 sr5, 5spd - back on the road, doing DD duty for now 86 2wd reg cab - future project 90 sr5, 97 - gone

09-03-2004, 07:55 PM	#6 (permalink)
calg3 Registered User Join Date: Jul 2003 Location: Old Line State Posts: 1,042	I found this on the web: Today I'm going to explain to you guys what lsass is. What is it? Local Security Authentication Server What does it do? It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token. You will not be able to end this through task manager! If yours is using that much memory, I would be concerned about a virus. My Win XP PC is using 00 for lsass.exe I use Zone Alarm, AdAware, McAfee VirusScan 7.1 and MS Firewall and don't have it running. I also remove MS File and Printer Sharing. Good luck. __________________ 2006 Subaru Outback, miss my 4Runner! 2006 Mazda3, zoom, zoom... Look at my previous truck(s) in the Yotatech gallery: http://yotatech.com/showthread.php?t=42494

09-04-2004, 05:14 AM	#7 (permalink)
MvCrash Contributing Member Join Date: Jul 2004 Location: Northern NJ Posts: 342	Greetings, Sounds like the "Sasser" worm might be your problem. Go to your virus scanner support and download the instructions on removal. There is a tool I believe. Then boot into safe mode without net support (no authentication) and have at it. My opinion, take your valuables off, repartition, reformat, reinstall. FYI...http://securityresponse.symantec.com...oval.tool.html MV __________________ MvCrash 2005 Rav4L Stock for now 2003 Mustang Mach 1, 4.6 DOHC V8. Cold air intake,magnaflow cross over and cat back, Custom tune by Predator SOLD:2001 Tacoma XCab, Michelin LTX, AmeraGuard Spray in Liner, Access Roll-Up Tonneau Cover, Synthetic Oils

09-04-2004, 10:05 AM	#8 (permalink)
Yoda Super Moderator Staff Join Date: May 2002 Location: North Bend, WA Posts: 2,664	My lsass is 1,480 k __________________ David TLCA 14788 71 Landcruiser FJ-40 TBI 327, TH-350, Warn 8000, disk axle swap. 76 Landcruiser FJ-40 project/parts (haven't decided)

09-04-2004, 11:15 AM	#9 (permalink)
Yoda Super Moderator Staff Join Date: May 2002 Location: North Bend, WA Posts: 2,664	This inspired me to run a scan on my computer. Had a trojan horse lurking in one of my son's folders. McAffee took it out. He hasn't used my computer in months, and previous scans had not shown it! __________________ David TLCA 14788 71 Landcruiser FJ-40 TBI 327, TH-350, Warn 8000, disk axle swap. 76 Landcruiser FJ-40 project/parts (haven't decided)

09-03-2004, 07:36 PM	#4 (permalink)
oly884 Contributing Member Join Date: Dec 2002 Posts: 4,703	Ok, so mcafee showed no sign of an infection. I restarted my computor, and now explorer is running at 83,772 KB and LSASS is running at 36,588 KB. Something is going on here and I know it isn't right. I can't find any thing on the net as to the cause of this. Any other suggestions?

09-03-2004, 07:42 PM	#5 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,074	26,964 for my Exploder shell. That is weird what is going on. Sorry I do not have an answer.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Starting the process of the SAS...	4Runner92sr5	Solid Axle Swaps, All Years	143	04-12-2008 12:53 PM
In the process of bleeding brakes and keep getting bubbles...	UNR.Grad	95.5-2004 Tacomas & 96-2002 4Runners	13	06-03-2007 10:04 PM
Invention Process	iGGz	Off Topic Talk	29	04-25-2007 04:40 PM
Job interview process... Now what do I do?	SLC Punk	Off Topic Talk	6	11-04-2004 08:11 AM
Anti-rustification process has begun!	Plays_with_Toys	95.5-2004 Tacomas & 96-2002 4Runners	1	10-28-2003 08:50 AM