Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Lsass is trying to connect...

  1. #1
    zonepud Guest

    Default Lsass is trying to connect...

    I get this alert almost every day when I start my computer. Zone alarm says that Lsass or LSA shell export version is trying to connect. I've checked and rechecked this and it's NOT the worm, it's in the right directory, and all my virus and spyware scans reveal nothing untoward going on. I check this to always allow but it keeps coming back. Do I have a zone alarm problem here or a windows problem? Or should I just keep checking this. I suspect the problem started after a windows security update maybe a currupted windows file?

    TIA

    Paul.

    Operating System:Windows XP Home Edition
    Product Name:ZoneAlarm Pro
    Software Version:6.1

  2. #2
    socalreviews Guest

    Default Re: Lsass is trying to connect...

    You can Google any of those file names to find out what they are. Lssas.exe is a windows system file that is normal to be running. In some cases it can be a virus as mentioned below but that is very unlikely that it is. I have lssas.exe running on my system right now. You might want to see what address lssas.exe is trying to connect to. If the address is on your local network or it is your own computer then it is no big deal.

    - "lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.

    Note: The lsass.exe file is located in the C:\Windows\System32 folder. In other cases, lsass.exe is a virus, spyware, trojan or worm!

    I remember having that same alert come up for me a while back when I was running an earlier version of ZAP and right at this moment I can't remember what I did to get rid of it. First of all if you are using a NAT router make sure that you have put your own computer in the Zone Alarm firewall's Trusted Zone. I think I might have allowed it to run but as I remember...a newer version of ZAP didn't have the lssas.exe pop up alert. I don't think you need to worry too much about it and maybe just allow it and check the box to always allow unless you suspect it to be a virus or worm as indicated above. You could always change your options for it under the Zone Alarm program control later on if you want to.

    Message Edited by SoCalReviews on 03-07-200603:03 PM

  3. #3
    flyyourway Guest

    Default Re: Lsass is trying to connect...

    I would also recommend you search THIS forum for Lsass.exe shell export

  4. #4
    zonepud Guest

    Default Re: Lsass is trying to connect...


    <blockquote><hr>SoCalReviews wrote:
    You can Google any of those file names to find out what they are. Lssas.exe is a windows system file that is normal to be running. In some cases it can be a virus as mentioned below but that is very unlikely that it is. I have lssas.exe running on my system right now. You might want to see what address lssas.exe is trying to connect to. If the address is on your local network or it is your own computer then it is no big deal.

    - &quot;lsass.exe&quot; is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.

    Note: The lsass.exe file is located in the C:\Windows\System32 folder. In other cases, lsass.exe is a virus, spyware, trojan or worm!

    I remember having that same alert come up for me a while back when I was running an earlier version of ZAP and right at this moment I can't remember what I did to get rid of it. First of all if you are using a NAT router make sure that you have put your own computer in the Zone Alarm firewall's Trusted Zone. I think I might have allowed it to run but as I remember...a newer version of ZAP didn't have the lssas.exe pop up alert. I don't think you need to worry too much about it and maybe just allow it and check the box to always allow unless you suspect it to be a virus or worm as indicated above. You could always change your options for it under the Zone Alarm program control later on if you want to.

    Message Edited by SoCalReviews on 03-07-200603:03 PM
    <hr></blockquote>


    Thanks,

    I've already googled it and I know what the Lssas is, the problem is that the alert keeps poping up even when I authorize, and try to authorize it perminantly. It's like zone alarm doesn't remember it's asked me about this program before. I wouldn't worry about it but I'm wondering if it indicates a deeper problem.

    thanks again,

    Paul.

  5. #5
    socalreviews Guest

    Default Re: Lsass is trying to connect...

    I did not know your level of knowledge about lssas on the previous post so I wanted to throw my information into the mix. I did have a similar lssas pop up alert last year (with a ZAP version 6.0.x) and as I mentioned it went away after a later ZAP version 6.1 upgrade. I can't really remember but I might have approved the program manually in the firewall settings. I do remember some how the pop up either went away or I was able to get it to go away so don't give up just yet on solving this pop up annoyance. Maybe you should look into turning off a part of the service if it doesn't effect your ability to use your system. I ended up turning off a number of services that were chewing up resources and I had to go into Administrative Tools to properly get them from starting. I also found a link on the Microsoft support site on how to keep the annoying Messenger program from forcing itself to start. I actually had to edit the registry to stop it from always starting since the other selective methods didn't completely work.

  6. #6
    heero139 Guest

    Default Re: Lsass is trying to connect...

    I and my brother are having a similar problem. Our problem is that no matter how many times we tell it remember this setting it will not remember it. I have even gone into the program settings section and manually cleared it, and have tried each option in the advanced settings. It just shows up as &quot;REPEAT PROGRAM&quot; and it wont stop. Its popping up in games while my brother is playing and causes some instability, as some of his games crash when this pops up.

    We are both on fully updated Windows XP PRO SP2

  7. #7
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: Lsass is trying to connect...

    If any program is not remembering the settings you have allowed it, delete the program and press on. Next time it pops up it should be remembered.
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  8. #8
    zonepud Guest

    Default Re: Lsass is trying to connect...


    <blockquote><hr>Hoov wrote:
    If any program is not remembering the settings you have allowed it, delete the program and press on. Next time it pops up it should be remembered.
    <hr></blockquote>


    Do you mean delet it from the ZA program list? I tried that thinking the same thing, it's back. The good thing is I've learned from this forum that others have had the same problem, and it's not a huge deal just tedious to keep checking it. Please clarify where and what I should delete, thanks,

    Paul.

  9. #9
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: Lsass is trying to connect...

    You got it right. Sorry for not being more clear.Is your program control on medium? If not try putting it there for another week or so.
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  10. #10
    zonepud Guest

    Default Re: Lsass is trying to connect...


    <blockquote><hr>Hoov wrote:
    You got it right. Sorry for not being more clear.

    Is your program control on medium? If not try putting it there for another week or so.
    <hr></blockquote>

    Yes, the program control is on medium, but I'll try experimenting with that. When I put it on low, the messege stops,but I've decresed my security haven't I?. Do I really need the firewall on medium? All the programs are loaded, and I'm behind a router firewall as well? I also tried deleting all the &quot;processes&quot; in the program conrol so they would reset as well ( I noticed a lot of references to programs that have been deleted ) but that didn't stop the alert either.

    I'll let you know what I find out.

    Paul.

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •