LSA Shell
 

Just been quietly minding my own business when Zone Alarm just asked me if I want LSA Shell to connect to the web. I've never heard of it before so I denied access but have no ideas what it is. I did a google and found out that the sasser worm might have something to do with it but nothing I found actually told me what it is and whether I should allow it to connect (most results just said that users get a 'LSA Shell error' message, none of them mention a ZA alert) so does anyone know what it's about?

Re: LSA Shell
 

Could it be spyware/ad aware/mailware or a nasty program?

Re: LSA Shell
 

I don't think so. I ran NAV 2004 last night which also scans for spyware and nothing came up.

Re: LSA Shell
 

Unless it happens again you can probably ignore it. Does norton tell you what process made the request ?

Re: LSA Shell
 

No, it was ZAP which alerted me.

Re: LSA Shell
 

Ok, does ZAP tell you :)

Re: LSA Shell
 

What's the filename?
"something.exe"?

Re: LSA Shell
 

:shocked: isass.exe

Why hasn't norton picked this up??

edit - hang on, it's actually Lsass.exe but with a lower case 'L' which makes it look like the sasser version which is 'isass' with an upper case 'i'. Look like the version I've got is a legitimate part of Windows.

Re: LSA Shell
 

lsass is part of the security manager for the Windows kernel - leave well alone. ;)

Re: LSA Shell
 

If you have SP2 installed its to do with the Security Centre.

Re: LSA Shell
 

No it's not, it's the local security manager for Windows NT4, 2000 and XP.

EDIT: http://www.liutilities.com/products/...library/lsass/
http://www.iamnotageek.com/a/119-p1.php

Re: LSA Shell
 

Try seaching and/or asking here Russ - http://forum.zonelabs.org/zonelabs

To start with I'd give it Access Trusted but otherwise ask (tick ? ? ?)

Re: LSA Shell
 

Leave it denied. I cannot think of any reason the security sub system would need web access.

Re: LSA Shell
 

Me neither - hence the allow Trusted Access (i.e. not the Internet) and otherwise ask (?).

I tend to set permissions to ? for a bit, just to see what access the program needs. Using the information in the alerts, I might add servers to the trusted zone and create expert rules.