Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My RAM is constantly at 5+ gigabyte used, most of it taken up by lsass.exe. I've already done a full system scan for virusses and malware, but found nothing.

After digging in my system logs, I did find a whole lot of errors for Schannel:

- System 
  - Provider 
   [ Name]  Schannel 
   [ Guid]  {1F678132-5938-4686-9FDC-C8FF68F15C85} 
   EventID 36887 
   Version 0 
   Level 2 
   Task 0 
   Opcode 0 
   Keywords 0x8000000000000000 
  - TimeCreated 
   [ SystemTime]  2013-04-20T01:04:43.693414200Z 
   EventRecordID 147497 
   Correlation 
  - Execution 
   [ ProcessID]  876 
   [ ThreadID]  924 
   Channel System 
   Computer Andreas-PC 
  - Security 
   [ UserID]  S-1-5-18 
- EventData 
  AlertDesc 48 

Could anyone provide me with a solution for this?

Thanks.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Lsass.exe is Windows' Local security authentication server. Or it's also called Local Security Authority Process. It is lsass.exe on the filesystem. It resides in *C:\Windows\System32* folder.

Check to see if the lsass.exe process on your machine that is taking up so much memory is the actual windows lass.exe in the folder I mentioned above. If not, likely it's a virus. I've never seen lsass.exe take more than 3 MB of memory.

Unfortunately, it's very nearly impossible to diagnose anything with such little information, and without actually looking at what's currently also running on your system...

This might seem like a stupid question, but are you positive no other user accounts are logged onto (but not active) on Windows? That might explain why lsass.exe was taking up so much memory, but even then... 5GB is way too much!

I would also try to match and see if you can figure out what processes are using those processIds that show up in the error logs for Schannel. That might be a good clue. You can find more about schannel here.

Hope this helps somewhat!

share|improve this answer
    
I had an additional account from Eset Smart Security for anti-theft. After I removed that one, my RAM usage dropped a few gigs, so I guess that it was badly optimized (or I'm just unlucky with it) –  Andreas Apr 20 '13 at 14:41
    
@Andreas : A few gigs! o.0 Geez... I'd suggest perhaps using something a little lighter for anti-theft... I use the free Prey application, which I also use to protect my Android phone –  unknownprotocol Apr 20 '13 at 18:07
    
I also found it strange so I reactivated it and it seems to work fine now (lsass.exe is at 3 mb). Kinda weird but I'll keep monitoring it. –  Andreas Apr 21 '13 at 10:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.