LSASS.EXE CPU 100% at boot

pmenuez · 15 Oct 2010

When I boot my computer (Dell E521/AMD 2Core/4Gig) it starts all of the programs it is supposed to but after a minute or two the CPU starts running at 100%. This will last for 10 - 20 minutes.

When I look at the processes running is shows LSASS.EXE running at between 70 and 100% CPU time.

I have run spyware/malware checks and virus scanned my computer. I was successful removing a bunch of spyware but no help on the run away CPU issue.

I am running Win 7 Home Edition, upgraded from Vista.

Any help would be appreciated.

Desslok · 15 Oct 2010

List all the anti-spyware/malware/virus softwares that you use.

pmenuez · 15 Oct 2010

AVG/Spybot Search and Destroy

whs · 15 Oct 2010

Normally the lsass.exe is there to check the legality of your installation. But that should not block your CPU. There are, however, also viruses that use the name. The real lsass.exe should be in C:\Windows\System32. Check the path of your bugger. If that is different, then it is not genuine.

Btw: with AVG and Spybot you have very weak tools for malware checking. I suggest you use Mawarebytes and/or Superantispyware. You may also consider to replace AVG with MSE.

madtownidiot · 15 Oct 2010

just to be the devils' advocate:

I wonder where the legal judgement would fall regarding removing a portion of the OS when it can be proven that it causes undue wear on your system... Especially if you have a receipt for the disk in your file cabinet....laws, contracts and agreements are never written in stone.

logicearth · 15 Oct 2010

whs said:

Normally the lsass.exe is there to check the legality of your installation.

Actually...lsass.exe (Local Security Authority Subsystem Service) handles enforcing the security policy. Verifying User logins, creating access tokens, etc. You cannot remove the real lsass.exe.

Bill2 · 15 Oct 2010

madtownidiot said:

just to be the devils' advocate:

I wonder where the legal judgement would fall regarding removing a portion of the OS when it can be proven that it causes undue wear on your system... Especially if you have a receipt for the disk in your file cabinet....laws, contracts and agreements are never written in stone.

I dont know about legal judgement but you'll be unable to get into your computer if you kill lsass.exe. Read more here.

lsass.exe - What is lsass.exe

madtownidiot · 15 Oct 2010

Bill2 said:

madtownidiot said:

just to be the devils' advocate:

I wonder where the legal judgement would fall regarding removing a portion of the OS when it can be proven that it causes undue wear on your system... Especially if you have a receipt for the disk in your file cabinet....laws, contracts and agreements are never written in stone.

I dont know about legal judgement but you'll be unable to get into your computer if you kill lsass.exe. Read more here.

lsass.exe - What is lsass.exe

I was just speaking hypothetically anyway..
I almost never have a problem with any single process taking up 100% of the CPU load at startup once the system is set up correctly... My belief is anything other than a benchmark that needs 100% of your CPU time for more than a few seconds during the initial program start is either incorrectly configured or is installed on an inadequate system

pmenuez · 15 Oct 2010

Thanks for the responses. I'll check out the software recommended.

There is only on instance of LSASS.EXE in windows\system32 but there are 3 additional instances in 3 other directories. (one of the directories is copyied below as an example. All three directories are in the x86_microsoft...)

C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16484_none_a61fe281be1fb177

logicearth · 15 Oct 2010

Those that are in WinSxS are alright, they are different versions of the one in System32. In fact the one in System32 is a hardlink to the latest version in WinSxS. So you only have three, not four. (Update...there is actually only one, all four are hardlinked to each other.)