информация о вирусе lsassexe

Local Security Authority Service

lsass.exe. What is it? The process lsass.exe is the Local Security Authentication Server . It is a safe file from Microsoft and is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.

Whenever a user tries to access the computer, lsass checks if the users identification is valid or not. The system uses lsass.exe to prevent unwanted users from accessing any private information. Also the file lsass handles user password modifications. If authentication is successful, lsass generates the users access token, which is used to launch the initial shell. This token includes the files security descriptor, which contains the necessary information to process user authentication.

Forcible termination of this windows process will result in the Welcome Screen losing its accounts and you will be prompted to restart your computer.

This might happen if the Authenticated Users group doesnt have the Read permission and the Apply Policy permission to access at least one GPO that is applied to domain computers. To fix this problem, you will need to grant the Authenticated Users group the Read permission and the Apply Policy permission to the default domain policy.

In most cases, lsass.exe system error and lsass.exe application error make the computer unusable, because the user authentication token cannot be obtained from the server.

In some cases, the error may be caused by a trojan, that camouflages itself as the lsass process. If the system is not infected, the error is caused by missing or corrupt configuration file and Registry entries. You can .

Malware often pretends to be lsass.exe . For example, the Sasser worm found a vulnerability in LSASS and spreads via a remote buffer overflow in Windows XP and Windows 2000 computers. This worm can spread without any interaction with humans, nor does it travel by email like many other worms. Scan your computer with to make sure its not infected.

If your computer enters a reboot loop because of an lsass.exe error, you get an lsass.exe error when trying to change your password, or the errors are caused by an infections, do the following:

After booting into Windows quickly click Start and then Run Type in shutdown -a and press Enter.

source