lsass.exe hits on HDD

GSteven · Jan 11, 2005

Is it normal for lsass.exe to constantly write to the hard HDD? If I bring
up task manager and look at processes with I/O read and write showing I see
an ever increasing number of hits on the HDD.

????

PS - I'm cross posting this to the security & performance groups as I do not
konw if it is a security or performance issue.

David H. Lipman · Jan 11, 2005

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt341.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM .

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode [F8 key during boot]
and shutdown as many applications as possible.
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

* * * Please report your results ! * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html

| Is it normal for lsass.exe to constantly write to the hard HDD? If I bring
| up task manager and look at processes with I/O read and write showing I see
| an ever increasing number of hits on the HDD.
|
| ????
|
| PS - I'm cross posting this to the security & performance groups as I do not
| konw if it is a security or performance issue.
|
|

GSteven · Jan 11, 2005

David,

Shall I assume from your reply that it is NOT normal activity that I
described in my original post??

will post results
Thanks
Steve

David H. Lipman · Jan 11, 2005

GSteven · Jan 11, 2005

OK, I dloaded and ran all apps. (BTW I already have and run Adaware 7x and
AVG on a daily basis.) Stinger found nothing. Trendmicro product scanned for
over a hour then crashed. I went to their web page and ran the scan listed
there, which also found nothing. The machine in general is clean and is kept
that way by careful selection of where I go on the web for business only
purposes.

I would still like someone to answer the initital question with some
authority and info from MS to back it up. That question being;

Is it normal for lsass.exe to constantly write to the hard HDD? If I bring
up task manager and look at processes with I/O read and write showing I see
an ever increasing number of hits on the HDD.

Thanks again,
Steve

David H. Lipman said:
1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt341.zip

Extract the contents of the ZIP file and place the contents in the same
directory as
SYSCLEAN.COM .

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode [F8 key during boot]
and shutdown as many applications as possible.
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of
your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform
using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore
preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

* * * Please report your results ! * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html

| Is it normal for lsass.exe to constantly write to the hard HDD? If I
bring
| up task manager and look at processes with I/O read and write showing I
see
| an ever increasing number of hits on the HDD.
|
| ????
|
| PS - I'm cross posting this to the security & performance groups as I do
not
| konw if it is a security or performance issue.
|
|

Richard Urban · Jan 12, 2005

Doing it here. I have no discernable problem/condition with my system. I am
not worried about it.

--
Regards,

Richard Urban

aka Crusty (-: Old B@stard :-)

If you knew as much as you thought you know,
You would realize that you don't know what you thought you knew!

GSteven said:
OK, I dloaded and ran all apps. (BTW I already have and run Adaware 7x and
AVG on a daily basis.) Stinger found nothing. Trendmicro product scanned
for over a hour then crashed. I went to their web page and ran the scan
listed there, which also found nothing. The machine in general is clean
and is kept that way by careful selection of where I go on the web for
business only purposes.

I would still like someone to answer the initital question with some
authority and info from MS to back it up. That question being;

Is it normal for lsass.exe to constantly write to the hard HDD? If I bring
up task manager and look at processes with I/O read and write showing I
see an ever increasing number of hits on the HDD.

Thanks again,
Steve

David H. Lipman said:

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt341.zip

Extract the contents of the ZIP file and place the contents in the same
directory as
SYSCLEAN.COM .

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode [F8 key during boot]
and shutdown as many applications as possible.
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of
your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform
using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore
preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

* * * Please report your results ! * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html

| Is it normal for lsass.exe to constantly write to the hard HDD? If I
bring
| up task manager and look at processes with I/O read and write showing I
see
| an ever increasing number of hits on the HDD.
|
| ????
|
| PS - I'm cross posting this to the security & performance groups as I
do not
| konw if it is a security or performance issue.
|
|

Click to expand...