Help Please: multiple copies of some exe and dll files in system32 folder

  • Thread starter Thread starter Ask A. Question
  • Start date Start date
A

Ask A. Question

An example is lsass:

lsass(3).exe 13k 8/4/2008 12:56 AM
lsass(2).exe 13k 4/14/2008 5:42 AM
lsas.exe) 13k 8/4/2004 12:56 AM

There are .DLL files with multiple copies as well.

Any help or explanation would be greatly appreciated.

Mike

m.k.b.e.r.k..at..p.a.c.b.e.l.l..n.e.t
 
An example is lsass:

lsass(3).exe 13k 8/4/2008 12:56 AM
lsass(2).exe 13k 4/14/2008 5:42 AM
lsas.exe) 13k 8/4/2004 12:56 AM

There are .DLL files with multiple copies as well.

Any help or explanation would be greatly appreciated.

Mike

m.k.b.e.r.k..at..p.a.c.b.e.l.l..n.e.t
Click to expand...

Googled lsas.exe and got numerous hits as a Trojan, this is just one:
http://www.processlibrary.com/directory/files/lsas/

For lsass.exe I got these hits:
http://www.liutilities.com/products/wintaskspro/processlibrary/lsass/
....the one above is a bit confusing, of course they are trying to sell
you their scan tool.

http://www.neuber.com/taskmanager/process/lsass.exe.html

http://www.file.net/process/lsass.exe.html
....the above has more technical info, especially filesize to identify
the virus version versus the Windows legit "Local Security
Authentication Server" (LSA Server) version.

On my home WinXP SP3, lsass.exe = 13,312 bytes which according to the
file.net article is the legit version.

Being you have multiple versions is specious. Check the filesize.

Do you run a good AntiVirus? If YES, update definitions and run a
full scan.
 
Back
Top