# problem with lsass.exe **URL:** \ **Category:** Factual Questions\ **Created:** [July 6, 2003, 1:35pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566 "2003-07-06T13:35:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![robertliguori](https://avatars.discourse-cdn.com/v4/letter/r/46a35a/32.png) [@robertliguori](https://boards.straightdope.com/u/robertliguori)\ **Post date:** [July 6, 2003, 1:35pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/1 "2003-07-06T13:35:34Z")
My computer is running WinXP. For some reason, my computer is generating a copy of this file in C: and apparently running it upon startup, as I have two entries for lsass.exe under my username, in addition to the one under SYSTEM in the task manager. I have also noticed a very minor slowdown on some programs. Does anyone have any ideas? I can’t delete the EXE, as lsass.exe is running, and I can’t kill the programs in the task manager, as they are system processes. More importantly, it appears from the way that the file’s date changes that it is appearing whenever I turn on the computer. Any ideas? ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [July 6, 2003, 1:42pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/2 "2003-07-06T13:42:12Z")
> [@](#): > > LSA Shell (Export Version) (file name lsass.exe) is a component of Windows NT and 2000 operating systems that helps administer access permissions. It sometimes requires access to the Internet to perform legitimate tasks. It is normal for this program to request access permission, and it is safe to grant permission. keep in mind though Trojan horses and other malware sometimes masquerade as legitimate programs by using the same file name. From [here.](http://www.annoyances.org/exec/forum/winxp/n1055882617) Remember, Win XP is an NT platform. Why did you want to delete it? ---
**Author:** ![Desmostylus](https://avatars.discourse-cdn.com/v4/letter/d/c57346/32.png) [@Desmostylus](https://boards.straightdope.com/u/Desmostylus)\ **Post date:** [July 6, 2003, 1:44pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/3 "2003-07-06T13:44:17Z")
**L** ocal **S** ecurity **A** uthentication **S** erver. But if your computer is running a copy of it from the root directory, C:, it could be a trojan. ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [July 6, 2003, 1:50pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/4 "2003-07-06T13:50:33Z")
**Desmostylus** has a point. It would be a good idea to run an _updated_ virus scan on it, just to be sure. McAfee and other anitvirus software vendors have trial versions of their software, and some offer free online scanning if you can’t or don’t wish to purchase one at this time. ---
**Author:** ![Desmostylus](https://avatars.discourse-cdn.com/v4/letter/d/c57346/32.png) [@Desmostylus](https://boards.straightdope.com/u/Desmostylus)\ **Post date:** [July 6, 2003, 2:02pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/5 "2003-07-06T14:02:16Z")
From looking around a bit in Google, yes, it’s a known trojan. There are several variants listed at Symantec. Do what **Q.E.D.** said. ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [July 6, 2003, 2:07pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/6 "2003-07-06T14:07:30Z")
Also see [here](http://vil.nai.com/vil/content/v_100072.htm) for some additional removal instructions. ---
**Author:** ![robertliguori](https://avatars.discourse-cdn.com/v4/letter/r/46a35a/32.png) [@robertliguori](https://boards.straightdope.com/u/robertliguori)\ **Post date:** [July 6, 2003, 4:52pm UTC](https://boards.straightdope.com/t/problem-with-lsass-exe/186566/7 "2003-07-06T16:52:43Z")
Thanks for the help. I think the virus is gone (no registry keys/dlls where the help files say they should be, and the utilities say it’s gone) but I still have two instances of lsass.exe executed under ‘USER’ in the task manager, and still have the copy of it in C:. Anyone have any tips on killing that file?