Read Time: 5 minutes
- Location: C:\Windows\System32\lsass.exe
- Signer: Microsoft Windows (important to identify because many malware pose as this security process).
- Instances running in the background: There should be only one lsass.exe process running in the background, launched by wininit.exe.
- Process name: The name should be lsass.exe only; don’t trust any other variation.
Seeing lsass.exe as one of the running processes in the Task Manager can be confusing, and honestly, a bit alarming as well. Local Security Authority Subsystem Service file, also known as lsass.exe, is an important Windows process that handles user authentication and manages security policies. Since it handles such a critical component of a Windows system, attackers sometimes disguise malware under this name to gain access and remain undetected. That’s why many users think it’s some kind of virus.
In this article, we’re going to discuss what lsass.exe does in Windows, how to identify the actual lsass.exe file from a fake one, and the step-by-step process to remove the fake file (malware) safely from your system.
Basic Functions of lsass.exe File
As stated above, lsass.exe file is responsible for verifying the validity of user logins to your PC or server and generating processes to authenticate users for the Winlogon service.
What does lsass.exe do?
- User authentication: Uses Kerberos or NTLM to verify the username and password of users during local or domain login attempts.
- Access tokens: Once the login is successfully completed, it generates security access tokens that contain the user’s SID, all the permissions & privileges, and group memberships. These tokens determine which files, folders, and organizational resources a user can access.
- Caching credentials: Saves memory of confidential session data like Kerberos tickets and NTLM hashes to support Single Sign-On (SSO).
- Implementing security policies: This process also supports implementing security policies like managing password rules, account lockouts, and adding audit logs to the Windows Security Log.
- Maintains system stability: Lsass.exe must run continuously, as Windows can’t run without it. Ending this process or removing the lsass.exe files will log you out of Windows, which will trigger an automatic restart. You must properly check whether the files you have are genuine or not.
Signs Of Presence Of Fake lsass.exe Files?
From the following signs, you can infer the presence of fake files:
- Computer is running very slowly, which is unusual.
- Computer crashes randomly.
- Display of strange errors.
- Unexplained installation of browser add-ons or other programs without your knowledge or consent.
How to Identify a Fake lsass.exe File?
You can use 3 factors to identify a fake lsass.exe file, viz;
- Location of file
- Spelling of file
- isass.exe
- Isass.exe (here ‘I’ is ‘i’ in uppercase)
- lsassa.exe (here ‘l’ is ‘L’ in lowercase)
- Isassa.exe(here ‘I’ is ‘i’ in uppercase)
- lsasss.exe(here ‘I’ is ‘L’ in lowercase)
- Isasss.exe(here ‘I’ is ‘i’ in uppercase)
- 1sass.exe
- 1sassa.exe
- 1sasss.exe
- Size of file
- When users logged in are more than one.
- When encrypted file writes on NTFS volumes.
- When user changes password.
- When the program is running on credentials of administrator and you open the program.
The one and only location where the real lsass.exe file exists is C:\Windows\System32. If you find any such file anywhere other than this location, like the desktop, downloaded folders, on a flash drive, etc., then the file is fake and can be dangerous, and you should delete it immediately.
The real lsass.exe is named “LSASS.EXE”, in lowercase only.
Files and processes with names similar to lsass.exe are fake files. Various variants of such similarly named files are be as given below:
You can check whether the file is real or not, by copying the file name and pasting it anywhere like on notepad and convert the whole to lowercase to detect the real name.
Malicious software usually has much large size. ‘lsass.exe’ file in Windows 10 is 57KB and 47KB in Windows 8. If you find a much bigger file then, it is most probably fake file. Usually lsass.exe file uses less than 10MB of memory at any time but, it may increase in situations like;
How To Remove Fake lsass.exe Files?
To remove the fake lsass.exe files from your computer follow the steps given under:
- Go to ‘Task Manager’
- Press tab ‘Processes’
- Find ‘Task’ and right-click.
- Select ‘End Task’
- If you do not find ‘Task’ in Processes Tab then press ‘Details’ Tab and find ‘Task’ there.
- Right-click ‘Task’
- Select ‘End process tree’.
- When you have closed the process, go to folder where the fake lsass.exe file is located and delete it.
You are also recommended to scan your PC using some efficient antivirus software and clean your system.
What ha
Conclusion
In this blog we discussed what lsass.exe file is, its importance, functions, and location. Further we discussed how imitate of this file can be a potent security threat/hazard to your PC. We have tried to guide our readers how to identify and get rid of such fake files and end security vulnerability of their PCs. If you’ve noticed that some of your files have gone missing or the malware has corrupted the system files, then Kernel Windows Data Recovery software can help in recovering all the files completely. Install it on a drive different from the one you want to recover data from. You’ll be able to recover all the data present in various drives excluding the drive where the software is installed.
Frequently Asked Questions
A. It is located solely in the C:\Windows\System32 folder and nowhere else.
A. No, lsass.exe is not a spyware. But, if any file with such name is present at any location other than C:\Windows\System32, then it is certainly a virus/spyware/Trojan or worm.
Further, lsass.exe file can become corrupted by virus or Trojan. Since this file is part of MS Windows, never delete or remove it, rather run an antivirus program to remove the virus.
A. Deleting a genuine lsass.exe file is not recommended, as it can break the logon process and force the system to restart.
