lsass.exe - what is it?
In this practical tip, we explain what the lsass.exe process is about.
lsass.exe: authentication server or virus
Lsass.exe can be the normal Windows authentication process or a virus or worm.
- lsass.exe is the local security authentication server. This process checks the validity of the user login for your PC.
- The original process is in the System32 folder. If the process is in another folder, then it is a virus.
- The notorious Sasser virus has been around for a while and is known to be more of an issue on old Windows operating systems like Windows XP.
- If you are not sure whether the normal process or a virus is on your PC, then check your PC with the Security Task Manager or Avira.
- Cleanup: The following Microsoft tool can be used to remove the Sasser virus. The tool has now been replaced by Microsoft malicious software removal software.
In the next practical tip, read how you can also check your PC for malware.