LSA Shell

  • Thread starter Thread starter inkleputDEL
  • Start date Start date
I

inkleputDEL

Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware. Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).


JimL
 
Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware.  Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).

JimL
Click to expand...

Hello Jim,

The LSA Shell in short is responsible for validating users for both
local and remote logins. This is the reason why it is acting as a
server - due to the remote logins that LSA can do.
More information about the LSA Shell can be found at:
http://www.outpostfirewall.com/forum/showthread.php?t=2306

As for the Sasser Virus, this is usually only found if it is LSA Shell
(Export Version).
More info on that can be found here:
http://forums.techguy.org/malware-removal-hijackthis-logs/400084-lsa-shell-export-version.html

If you do not use the Remote Login Feature in the LSA shell, it would
be a good idea to block it with your firewall for security reasons.

Hope this helps,

Nathan
 
Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware.  Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).

JimL
Click to expand...

Hello Jim,

In Short the LSA Shell is responsible for validating users for both
local and remote logins. This means that it will try to gain access to
the internet and act as a sever for the Remote Login Feature.
More information can be found at:
http://www.outpostfirewall.com/forum/showthread.php?t=2306

However, If you have LSA Shell (Export Version) then you may have some
trouble on your hands.
Look here if you think this matches your situation:
http://forums.techguy.org/malware-removal-hijackthis-logs/400084-lsa-shell-export-version.html

If it doesn't then all is fine. It would be advised to block the LSA
Shell in your firewall for security reasons if your not using its
remote login feature.

Hope this Helps,

Nathan.
 
Is there any NORMAL reason fot LSA Shell to want to access the internet as
a server?

I've run several "anti" softwares for viruses and spyware.  Nothing found
any evidence of the Sasser virus often associated with LSA Shell (and
lsass.exe).

JimL
Click to expand...

Sorry that I Posted this Twice. Please Disregard the Second Post.

Nathan
 
Back
Top