Hacker ?

[Zebb 7]

I was in the middle of a defrag when my Norton firewall popped up with the message something like " A remote system ia attempting to contact your LSA Shell" and wanted to know if i would give it access, obviously i blocked the connection.

I have no idea what that might be or why a remote system would want to connect to it, is it a hacker or is there a genuine reason for the message, thanks for any advice..

[Syncopator 0]

Is this not related to the msblast.exe worm that attempts to run via port 135...as in the big thread in computer discssions...and one that I suffered yesterday..

Or im I talking nonsense?

[NightCrawler 137]

Sounds like it might be a related issue, Zeb have you checked the other thread and then your PC?

[Dannik 43]

This is not part of the msblast virus, for the record.

the LSA shell (or lsass.exe) is a legitimate Windows 2000/XP tool foir managing access permissions, and is associated with several Microsoft web services, such as MSN Explorer, Frontpage 2002, and a slew of .NET based services.

It's reasonably harmless a process, as Windows 2000 SP3 and above (including XP) error checks the file as part of it's regular maintenance, to ensure that the file lsass.exe is the proper legitimate version.

Although you certainly could deny lsass.exe from connecting/being connected to via your firewall, you may notice some applications "breaking", but odds are slim that you would see that, and if you did, simply re-enable the service's access.

[Zebb 7]

Thanks for that Dann, i was wondering if it was related to the recent problems but clearly not, although i dont know why it would ask permission to join the internet when i am not using any of those programs and any i do have already have permission, i will wait and see if i have any problems with any of them, thanks again guys..