LSA

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(Default)	llsass.exe	"Added by the PROXY-GG TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	1	lsass.scr	"Added by the BANCOS.V TROJAN!"
X	678	lsas32.exe	"Added by the SLSORVE-B TROJAN!"
X	AASSKK2	LSASS.EXE	"Added by the SILLYFDC.BDB WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
?	AOLSAV	AOLAgent.exe	"AOL ISP related. What does it do and is it required?"
X	BuildLabs	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	ccpApps	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	CLSRSS	LSACS.EXE	"Added by the SILLYFDC-X WORM!"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	Computing Technologie Firewall	lsauth.exe	"Added by the SDBOT-WX WORM!"
X	DarKNesS LsasS	LsasS23.exe	Added by an unidentified WORM or TROJAN!
X	delsaap	delsaap.exe	"NCase adware"
X	dsadlsa14	dsakfsak14.exe	"Added by the ONLINEG-P TROJAN!"
U	ELSA WINman Suite	Winmsuit.exe	"Allows you to totally customize your ELSA graphics card settings
Y	ElsaCapiCtl	Rcapi.exe	"Assumed to stand for Remote Common Application Programming Interface (RCAPI)
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
X	FriendlyType	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	Generic Host Process	lsassw.exe	"Added by the AGOBOT-N WORM!"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
X	ilasss	lsass.exe	"Added by the INJECT-GZ TROJAN! Note - the legitimate lsass.exe process should not normally figure in Msconfig/Startup!"
X	internet	lsass.exe	"Added by the DSPY-A TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	Keyboard	lsass.exe	"Added by the AGENT.US WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %CommonAppData%\Fearghus"
X	Lexmark_X79-55	lsasss.exe	"Added by the ZONEBAC TROJAN!"
X	Local Authority Service	lsass.exe	"Added by the MARKTMAN-C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LogService	lsass.exe	"Added by the BDOOR-IU BACKDOOR! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LSA	wfdmgr.exe	"Added by the MYTOB.C WORM!"
X	LSA	lsa.exe	"Added by the SDBOT-YV WORM!"
X	LSA	msdn.exe	Added by an unidentified malware
X	LSA Service	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	lsa Services	lsa2srv.exe	"Added by the TAME-C WORM!"
X	LSA Shell (Export Version)	LSASS.exe	"Added by the AHKER.K WORM and variants. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LSA Shellu	lsass.exe	"Added by the AUTORUN-CW WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	LsaManager	lsamgr.exe	"Added by the BEAGLE.DR WORM!"
X	lsas	lsas.exe	"Added by the BIGFAIRY-C WORM!"
X	LSAShell	lsass.exe	"Added by the DAPROSY WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	lsass	lsass.exe	"Added by the RATSOU.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Debug\UserMode"
X	lsass	start.bat	"Added by the ZCREW TROJAN!"
X	lsass	[path to lsass.exe]	"Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup!"
X	lsass	lsasrv.exe	"Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS!"
X	Lsass	woekd.exe	Added by an unidentified WORM or TROJAN!
X	lsass	elite***32.exe	"EliteBar adware"
X	Lsass	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Lsass	Lsass.exe	"Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\mirc32"
X	LsasS	Sygate.exe	"Added by the SDBOT.BCA WORM!"
X	Lsass	kavmm.exe	"Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor
X	Lsass	LSASS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	LSASS 32	ISASS32.pif	"Added by the ASSIRAL-C WORM!"
X	Lsass 32 Manager	lsass32.exe	"Added by the SDBOT.EOG WORM!"
X	lsass 32-biT	lsass32.exe	"Added by the RBOT.QGC WORM!"
X	LSASS Authority	lshosts32.exe	"Added by the SDBOT-UY TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	LSASS Daemon	LSASSd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	lsass service	lsass2.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	lsass16	lsass16.exe	"Added by the BANKER-BXX TROJAN!"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
X	LSASS32	Isass32.exe	"Added by the KELVIR.M WORM!"
X	lsass32	lsass32.exe	"Added by the LYDRA-B TROJAN!"
X	lsass64BiT.exe	lsass64BiT.exe	"Added by the FORBOT-CK WORM!"
X	lsassig	lsassig.exe	"Added by the BANCOS-EC TROJAN!"
X	lsasss	lsasss.exe	"Added by the GEEKMY-A TROJAN!"
X	lsasss.exe	lsasss.exe	"Added by the SASSER.E WORM!"
X	Micrcoft Exploerer	spoolsal.exe	"Added by the RBOT-AKK WORM!"
X	Micrcoft Updat	spoolsae.exe	"Added by the RBOT-AIB WORM!"
X	Micrcoft Updat	spoolsaex.exe	"Added by the RBOT-AJM WORM!"
X	Microft Exploerer	spoolsac.exe	"Added by the RBOT-AMD WORM!"
X	Microsoft	lsass.ppf	"Added by the RBOT-GAA WORM!"
X	Microsoft Authority Service	lsass.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate lsass.exe process
X	Microsoft LSA layer	MSLSA32.exe	"Added by the RBOT-AKZ WORM!"
X	Microsoft Lsass Center	Isass.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Lsass Center	telecomes.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Lsass Manager	lsass.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate lsass.exe process
X	Microsoft Lsass Service	wintcp32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft LSASS386 Protocol	scvhost32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Security Monitor Process	lsas.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Server Applacations	lsasss.exe	"Added by the RBOT-AQQ WORM!"
X	Microsoft Update	lsac.exe	"Added by the GAOBOT.XW WORM!"
X	Microsoft Update Machine	lsasse.exe	"Added by the RBOT-DI WORM!"
X	Microsoft UPDATER32	lsass.exe	"Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
X	Microsoft UPDATER32	LSASS32.EXE	"Added by the RANDEX.AR WORM!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	MicrosoftSourceSafe	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	MS lsass Startup	lsass135.exe	"Added by the RBOT.WM WORM!"
X	MS Security Authority Service	lsass.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate lsass.exe process
X	MSN	lsass32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msnmsgr.exe	lsass.exe	"Added by the DWNLDR-GWE TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root directory (i.e. C:\ or D:\)"
X	msupdater25	lsasser.exe	"Added by the RBOT-ATS WORM!"
X	NDIS Adapter	lsass2.exe	"Added by the WOOTBOT.CW WORM!"
X	Norton Updater	lsa.exe	"Added by a variant of the RBOT WORM!"
X	NortonAntivirus	LSASS.exe	"Added by the PEXMOR WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Temp"
X	NviDiaGT	lsass.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	Nxvst	lsas.exe	"Added by the GAOBOT.CD WORM!"
X	Prog	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	RegDoneEx	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	RsWin	lsass.exe	"Added by the DELCANTI-B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""12053"" subfolder"
X	RsWin	lsass.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""4350"" subfolder"
X	RTHDBPL	lsass.exe	"Added by the ROUTROBOT WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\SystemProc"
X	Runner	lsass.exe [trojan filename]	"Added by the DROWSY-B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runner	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Security Mechanic	lsascs.exe	"Security Mechanic rogue security software - not recommended
X	Services Controller	lsassa.exe	Added by the CIADOOR.122 VIRUS!
X	ServicesLoad	lsass.exe	"Added by the DEARIS-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Shellspl	lsas.exe	"Added by the YALER-A TROJAN!"
X	SondBlaster	lsass.exe	"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X	Spy Protector	lsascs.exe	"Spy Protector rogue security software - not recommended
X	SYSTEM	lsas.exe	"Added by the SPYBOT.CJ WORM!"
X	system	lsasse.exe	"Added by the RBOT-YL WORM!"
X	system	lsass.exe	"Added by the SATILOLER.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	System Analyzer	lsass32.exe	"Added by the SDBOT.CNI WORM!"
X	System Handler	LSASS.EXE	"Added by the NIMOS WORM! Note - this is not the legitimate lsass.exe process
X	System Kernel	lsass.exe	"Added by the VBBOT-G TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Monitoring	lsass.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	System Process	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Protector	lsascs.exe	"System Protector rogue security software - not recommended
X	System32	lsasss.exe	"Added by the RBOT-XW WORM!"
X	Task	LSASS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate lsass.exe process
X	ToP	LSASS.exe	"Added by the WOWCRAFT.C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Traybar	lsass.exe	"Added by the MYDOOM.L WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Userinit	lsass.exe	"Added by the VIRAN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Program Files%\Common Files%\System"
X	ViSulaBaCis	lsass.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
X	Win32 LSA Driver	lsa.exe	"Added by the FORBOT-FJ WORM!"
X	WinDLL (slsass.exe)	"rundll32.exe slsass.exe	start"
X	Windows Authority Service	lsass.exe	"Added by the KALEL-E WORM! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	Windows auto update	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	Windows Explorer	Lsas.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Recavery Adware	lsass.exe	"Added by an unidentified TROJAN - see here. Note - this is not the legitimate lsass.exe process
X	Windows Security Authority Service	lsass.exe	"Added by the KALEL-A WORM! Note - this is not the legitimate lsass.exe process
X	Windows Security Policy	lsass32.exe	"Added by the AGOBOT-CR WORM!"
X	Windows Svchost Authority	slsass.exe	"Added by the RBOT-UA WORM!"
X	Windows System32	clsas32.exe	"Added by the RBOT-AZO WORM!"
X	Windows System32 Driver	clsass32.exe	"Added by the SDBOT-AGG WORM!"
X	Windows Taskmanager	lsassx.exe	"Added by the KELVIR.E WORM!"
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Updates	lsassx.exe	"Added by a variant of the SDBOT WORM!"
X	WindowsFirewall	lsass.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsProtocolLog	lsadst.exe	"Added by the NANINF.C TROJAN!"
X	WindowsUpdatelsasss	lsasss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	Windows_LowLevel_Security_Core	lsass.exe	"Added by the PADMIN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Repair"
X	Windows_Protect	lsas.exe	"Added by the RBOT.ARO WORM!"
X	WinExec	Lsass.exe	"Added by the CRUTLE-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WinFX	lsas.exe	"Added by the GAOBOT.CD WORM!"
X	Winlogon	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WinLsass	servicec.exe	"Added by the SCANE WORM!"
X	WinLsass	[path to trojan]	"Added by the SCANE WORM!"
X	WinTools	WToolsA.exe	"Wintools adware"
X	Winupdate	lsas.exe	"Added by the COSPET.JR TROJAN!"
X	WinXPService	lsass.exe	"Added by the ZAPCHAS-AS TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Lavan"" subfolder"
X	wlsass	wlsass.exe	"Added by the RANKY.CY TROJAN!"
X	ZincgrubInc	Lsass.exe	"Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\mirc32"
X	[random]	lsass.scr	"Added by the BANCBAN-CW TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.