lsass.exe and my hard drive (XP)

[chrisgreaves]

I've read through the post lsass.exe Memory Hog (XP Home SP1), although I'm XP professional, and it wasn't the memory hog that bothered me, it is the regular (every one second?) read and write of the hard drive. I can't find "GMT Services." so I can't kill that service.

I've read somewhere of a virus with a lower-case "I" in Arial font, hence "isass.exe", but Windows Explorer (hidden files &* folders) assures me I have only lsass.exe, and it is in the proper place.

I've read http://the-scream.co.uk/forums/t7883.html and used Adminstrative Tools to disable it, but it re-appears after a reboot.

I am tempted to delete lsass.exe by nefarious means, but can't find a definitive statement on what it does, who sponsors it, and what dire effects might befall me.

AFAIK the WinXP automatic updates have kept me up to date as of this morning.
I am uptodate with Grisoft anti-virus, Lavasoft AdAware, Spyware Terminator and Zonelabs ZoneAlarm.

[JoeP517]

Read lsass.exe Windows process - What is it? and lsass - lsass.exe - Process Information. Use Process Explorer for Windows v10.21 to see from where it is executing. You should not try to remove it unless you are sure it is malware.

Joe

[chrisgreaves]

Thanks Joe

>You should not try to remove it unless you are sure it is malware.
Agreed.
I read the three pages you quoted, downloaded the Process Explorer and while I don't yet comprehend its output, coupled with my various virus/spy monitoirs I'd have to believe that LSASS.EXE is harmless. So I'll leave it in place.

Nothing that I've read so far tells me why LSASS.EXE issues a read and a write burst every second. We are at 10,000 reads now (up from 4,000 at the time of my post less than 60 minutes ago).

I read that it takes care of logons, but there's no apparent reason for it read/writing so much.
I am a sole user/occupant with two networked machines that get booted up at 6am and left running.

[JohnGray]

There was a suggestion in the newsgroups that this read-write sequence by lsass.exe had something to do with the Disk Indexing Service. But my Indexing Service service is on manual and not started, and when you turn off the "Allow Indexing Service to index this disk for fast file searching" for the C: drive (and in my case, the external E: drive), there is no effect on the increasing I/O counts and I/O rates.

The only thing I have found that will affect the rate of clocking up of I/O Reads and I/O Writes in units of 6 per update is to change the View -> Update speed. High causes the values to increase much faster than Low (and, surprise, surprise, Pause stops the increases altogether!).

Perhaps we have an example of the Observer Effect here?

John

PS I have been enthusing about the usefulness of the Task Manager application for years, but I have never before realised that you could add additional columns into the Processes and Networking windows. You truly learn something new every day!

[chrisgreaves]

Thanks John,
>something to do with the Disk Indexing Service.
My Indexing is turned off, too. Furthermore, I noticed the disk activity by the green hard drive light flashing while running on batteries. The light blinked about once per second. I expect Indexer to thrash away continuously (as has been observed on the Big Beige Box)

>Pause stops the increases altogether
er, "Pause inhibits a change in the display of the increases altogether"? They don't stop; once I revert from Pause to Low I see another hundred or so I/O operations have been accumulated.


>truly learn something new every day!
Yes. In my case I learned that you learned something new today!


I don't intend to be overcome by lassitude on this one. It's not critical, but the blinking is so rhythmic that it had all the appearances of a machine being polled, or issuing periodic data. I do not use a wireless connection, so my batteries-in-bed mode is completely cut off from the outside world.

[HansV]

> I don't intend to be overcome by lassitude on this one

Don't you mean lsassitude?

[chrisgreaves]

> Don't you mean lsassitude?
No. That's what you are extending by not suggesting this thread be moved to the Scuttlebut!