LSASS.EXE CPU 100% at boot

[pmenuez]

When I boot my computer (Dell E521/AMD 2Core/4Gig) it starts all of the programs it is supposed to but after a minute or two the CPU starts running at 100%. This will last for 10 - 20 minutes.

When I look at the processes running is shows LSASS.EXE running at between 70 and 100% CPU time.

I have run spyware/malware checks and virus scanned my computer. I was successful removing a bunch of spyware but no help on the run away CPU issue.

I am running Win 7 Home Edition, upgraded from Vista.

Any help would be appreciated.

 

[Desslok]

List all the anti-spyware/malware/virus softwares that you use.

 

[pmenuez]

AVG/Spybot Search and Destroy

 

[whs]

Normally the lsass.exe is there to check the legality of your installation. But that should not block your CPU. There are, however, also viruses that use the name. The real lsass.exe should be in C:\Windows\System32. Check the path of your bugger. If that is different, then it is not genuine.

Btw: with AVG and Spybot you have very weak tools for malware checking. I suggest you use Mawarebytes and/or Superantispyware. You may also consider to replace AVG with MSE.

 

[madtownidiot]

just to be the devils' advocate:

I wonder where the legal judgement would fall regarding removing a portion of the OS when it can be proven that it causes undue wear on your system... Especially if you have a receipt for the disk in your file cabinet....laws, contracts and agreements are never written in stone.

 

[logicearth]

Normally the lsass.exe is there to check the legality of your installation.

Actually...lsass.exe (Local Security Authority Subsystem Service) handles enforcing the security policy. Verifying User logins, creating access tokens, etc. You cannot remove the real lsass.exe.

 

[Bill2]

just to be the devils' advocate:

I wonder where the legal judgement would fall regarding removing a portion of the OS when it can be proven that it causes undue wear on your system... Especially if you have a receipt for the disk in your file cabinet....laws, contracts and agreements are never written in stone.

I dont know about legal judgement but you'll be unable to get into your computer if you kill lsass.exe. Read more here.

lsass.exe - What is lsass.exe

 

[madtownidiot]

just to be the devils' advocate:

I wonder where the legal judgement would fall regarding removing a portion of the OS when it can be proven that it causes undue wear on your system... Especially if you have a receipt for the disk in your file cabinet....laws, contracts and agreements are never written in stone.

I dont know about legal judgement but you'll be unable to get into your computer if you kill lsass.exe. Read more here.

lsass.exe - What is lsass.exe

I was just speaking hypothetically anyway..
I almost never have a problem with any single process taking up 100% of the CPU load at startup once the system is set up correctly... My belief is anything other than a benchmark that needs 100% of your CPU time for more than a few seconds during the initial program start is either incorrectly configured or is installed on an inadequate system

 

[pmenuez]

Thanks for the responses. I'll check out the software recommended.

There is only on instance of LSASS.EXE in windows\system32 but there are 3 additional instances in 3 other directories. (one of the directories is copyied below as an example. All three directories are in the x86_microsoft...)

C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16484_none_a61fe281be1fb177

 

[logicearth]

Those that are in WinSxS are alright, they are different versions of the one in System32. In fact the one in System32 is a hardlink to the latest version in WinSxS. So you only have three, not four. (Update...there is actually only one, all four are hardlinked to each other.)

 

[madtownidiot]

right click on each instance and select go to service(s) to see which services they are attached to. There may be some services you can disable without affecting the functionality of your system.. here's lsass on an untweaked and clean 7 ultimate 64bit set up using full drive encryption:
View attachment 104956View attachment 104957

 

[Desslok]

AVG/Spybot Search and Destroy

Funny you mention those 2 because I have had the same issue with both of those on different machines. I used to use AVG all the time, but seems the new AVG realtime monitroing has caused 100% CPU on a couple of my machines, and Spybot caused similar issue on my netbook. I also had the same thing happen with Adaware's real time monitoring. I removed them all and threw on MSE and malwarebytes on all my machines and the issue went away.

 

[madtownidiot]

When cpu time is locked at 100% while using separate AV/AS/AM/FW software it's because each is trying to attack the other. The only way to efficiently run two RT scanners simulateously is if you are able to create exceptions in each for all executables, services and DLLs the others need to function correctly. One of the reasons McAfee, Kaspersky, Norton, AVG and many others don't play well with other products that use RT scanning is because UIs have been dumbed down to the point where it is impossible to do so.

 

[pmenuez]

I downloaded and ran both Malwarebytes and MSE - scanned, rebooted the problem has gone away (at least for now). Thanks for the help!