I'm guessing it had something to do with the windows update on November 13. However, everything read so far says lsass.exe does not access the internet. Webroot support says no infections were found on the system but wouldn't comment on why it might be acccessing the internet.
Solved
Anyone know why lsass.exe would be accessing the internet?
Best answer by yeoldfart
it's a legit exe belonging to windows update program, it must be allowed to access freely the internet, you can find it in C:windowssystem32 then right click on it and have it checked by WSA if you're still unsure. Sasser is a worm which used a security break in Lsass.exe, that security breach has been addressed by Microsoft long ago (it caused reboots and stopped Lsass.exe).
hope this helps
View originalhope this helps
+56I let it have access but does it need to? http://www.ehow.com/info_12173956_lsassexe-need-internet.html if you block it and you see any issues try unblocking to see if that fixes it. It's up to you.
Daniel ;)
Daniel ;)
1 person likes this
I agree. Everything read says it should not be accessing the internet, but it did. Many years ago (2005-2009??) there was a sasser virus that USED lsass to connect to the internet. In this case there was a 30 byte lsass.exe downloaded as part of (I think) the Microsof update. Perhaps it was accessing theinternet via system32lsass.exe to complete something about the update.
Since Microsoft doesn't talk about this I will leave it blocked. The downfall is that it may siiently leave me with an incomplete update. Unfortunately, Microsoft isn't going to answer my questions about what is going on. :(
Thanks again, Triple
Godspeed
Since Microsoft doesn't talk about this I will leave it blocked. The downfall is that it may siiently leave me with an incomplete update. Unfortunately, Microsoft isn't going to answer my questions about what is going on. :(
Thanks again, Triple
Godspeed
+22it's a legit exe belonging to windows update program, it must be allowed to access freely the internet, you can find it in C:windowssystem32 then right click on it and have it checked by WSA if you're still unsure. Sasser is a worm which used a security break in Lsass.exe, that security breach has been addressed by Microsoft long ago (it caused reboots and stopped Lsass.exe).
hope this helps
hope this helps
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.