关于windows上的lsass.exe进程

关于windows上的lsass.exe进程

作者:eygle

出处:http://blog.eygle.com

日期:December 26, 2004

« 安装cronolog,格式化Apache的日志文件 | Blog首页 | 配置AWStats，Apache日志分析工具 »

---

今天见到有人问lsass.exe进程，翻了点东西，记录些东西在这里。

lsass - lsass.exe - 进程信息
进程文件: lsass or lsass.exe
进程名称: 本地安全权限服务
描述: 本地安全权限服务，控制Windows安全机制。
常见错误: N/A
是否为系统进程: 是

该进程为系统进程，不能在任务管理器里终止，记得以前在命令行kill该进程，可能会导致系统蓝屏（不确认了）。

微软的说明如下:

Lsass.exe - You cannot end this process from Task Manager.
This is the local security authentication server, and it generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.

Link

意思是说:
这是一个本地的安全授权服务，并且它会为使用winlogon服务的授权用户生成一个进程。这个进程是通过使用授权的包，例如默认的msgina.dll来执行的。如果授权是成功的，lsass就会产生用户的进入令牌，令牌别使用启动初始的shell 。其他的由用户初始化的进程会继承这个令牌的。

但是适当的担心是有必要的，已知的部分病毒跟lsass有关。
首先，微软缺省的lsass.exe位于c:\windows\System32\lsass.exe

我们应该清楚正常运行lsass需要的动态链接库:

C:\>tlist 720

 720 lsass.exe

   CWD:     C:\WINDOWS\system32\

   CmdLine: C:\WINDOWS\system32\lsass.exe

   VirtualSize:    43208 KB   PeakVirtualSize:    49040 KB

   WorkingSetSize:  1360 KB   PeakWorkingSetSize: 10640 KB

   NumberOfThreads: 19

    732 Win32StartAddr:0x74497f07 LastErr:0x00000000 State:Waiting

    736 Win32StartAddr:0x7c94798d LastErr:0x00000000 State:Waiting

    740 Win32StartAddr:0x7c930760 LastErr:0x00000000 State:Waiting

    744 Win32StartAddr:0x7c949fae LastErr:0x00000000 State:Waiting

    748 Win32StartAddr:0x0000028e LastErr:0x00000000 State:Waiting

    764 Win32StartAddr:0x7c930aca LastErr:0x00000000 State:Waiting

    792 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

    800 Win32StartAddr:0x00040d64 LastErr:0x00000000 State:Waiting

    812 Win32StartAddr:0x74488c23 LastErr:0x00000000 State:Waiting

   1700 Win32StartAddr:0x74488c23 LastErr:0x00000000 State:Waiting

    212 Win32StartAddr:0x77dbb479 LastErr:0x00000000 State:Waiting

    364 Win32StartAddr:0x77c0a341 LastErr:0x000003e5 State:Waiting

    376 Win32StartAddr:0x77c0a341 LastErr:0x00000000 State:Waiting

    380 Win32StartAddr:0x77c0a341 LastErr:0x00000000 State:Waiting

   3056 Win32StartAddr:0x759d8831 LastErr:0x00000000 State:Waiting

   1048 Win32StartAddr:0x77e56bf0 LastErr:0x0000006d State:Waiting

   2628 Win32StartAddr:0x00000000 LastErr:0x000003f0 State:Waiting

   3204 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

   3032 Win32StartAddr:0x77e56bf0 LastErr:0x00000000 State:Waiting

  5.1.2600.2180 shp  0x01000000  lsass.exe

  5.1.2600.2180 shp  0x7c920000  ntdll.dll

  5.1.2600.2180 shp  0x7c800000  kernel32.dll

  5.1.2600.2180 shp  0x77da0000  ADVAPI32.dll

  5.1.2600.2180 shp  0x77e50000  RPCRT4.dll

  5.1.2600.2525 shp  0x74480000  LSASRV.dll

  5.1.2600.2180 shp  0x71a90000  MPR.dll

  5.1.2600.2180 shp  0x77d10000  USER32.dll

  5.1.2600.2180 shp  0x77ef0000  GDI32.dll

  5.1.2600.2180 shp  0x76db0000  MSASN1.dll

  7.0.2600.2180 shp  0x77be0000  msvcrt.dll

  5.1.2600.2180 shp  0x5fdd0000  NETAPI32.dll

  5.1.2600.2180 shp  0x76770000  NTDSAPI.dll

  5.1.2600.2180 shp  0x76ef0000  DNSAPI.dll

  5.1.2600.2180 shp  0x71a20000  WS2_32.dll

  5.1.2600.2180 shp  0x71a10000  WS2HELP.dll

  5.1.2600.2180 shp  0x76f30000  WLDAP32.dll

  5.1.2600.2180 shp  0x77fc0000  Secur32.dll

  5.1.2600.2180 shp  0x71b70000  SAMLIB.dll

  5.1.2600.2180 shp  0x743a0000  SAMSRV.dll

  5.1.2600.2180 shp  0x76760000  cryptdll.dll

  5.1.2600.2180 shp  0x5cc30000  ShimEng.dll

                     0x58fb0000  AcGenral.DLL

  5.1.2600.2180 shp  0x76b10000  WINMM.dll

  5.1.2600.2180 shp  0x76990000  ole32.dll

  5.1.2600.2180 shp  0x770f0000  OLEAUT32.dll

  5.1.2600.2180 shp  0x77bb0000  MSACM32.dll

  5.1.2600.2180 shp  0x77bd0000  VERSION.dll

  6.0.2900.2180 shp  0x773a0000  SHELL32.dll

  6.0.2900.2180 shp  0x77f40000  SHLWAPI.dll

  5.1.2600.2180 shp  0x759d0000  USERENV.dll

  6.0.2900.2180 shp  0x5adc0000  UxTheme.dll

  5.1.2600.2180 shp  0x76300000  IMM32.DLL

  5.1.2600.2180 shp  0x62c20000  LPK.DLL

 1.420.2600.2180 sh  0x73fa0000  USP10.dll

 5.82.2900.2180 shp  0x77180000  comctl32.dll

 5.82.2900.2180 shp  0x5d170000  comctl32.dll

  5.1.2600.2180 shp  0x20000000  msprivs.dll

  5.1.2600.2180 shp  0x71c70000  kerberos.dll

  5.1.2600.2180 shp  0x77c40000  msv1_0.dll

  5.1.2600.2180 shp  0x76d30000  iphlpapi.dll

  5.1.2600.2180 shp  0x74410000  netlogon.dll

  5.1.2600.2180 shp  0x76790000  w32time.dll

     6.0.8168.0 shp  0x75ff0000  MSVCP60.dll

  5.1.2600.2180 shp  0x767c0000  schannel.dll

 5.131.2600.2180 sh  0x765e0000  CRYPT32.dll

  5.1.2600.2180 shp  0x742e0000  wdigest.dll

  5.1.2600.2161 shp  0x0ffd0000  rsaenh.dll

  5.1.2600.2180 shp  0x74370000  scecli.dll

  5.1.2600.2180 shp  0x76060000  SETUPAPI.dll

  5.1.2600.2180 shp  0x74340000  ipsecsvc.dll

  5.1.2600.2180 shp  0x77fe0000  AUTHZ.dll

  5.1.2600.2180 shp  0x73ed0000  oakley.DLL

  5.1.2600.2180 shp  0x742d0000  WINIPSEC.DLL

  5.1.2600.2180 shp  0x74300000  pstorsvc.dll

                     0x43000000  GoogleDesktopNetwork1.dll

  5.1.2600.2180 shp  0x719c0000  mswsock.dll

  5.1.2600.2180 shp  0x60fd0000  hnetcfg.dll

  5.1.2600.2180 shp  0x71a00000  wshtcpip.dll

  5.1.2600.2180 shp  0x74320000  psbase.dll

  5.1.2600.2133 shp  0x68100000  dssenh.dll

大家可以看到，Google的桌面搜索也需要在此注册，这个进程是权限控制所必需的。
有的软件验证和更新或验证注册信息，会使用500端口通信(Internet Key Exchange(IKE)-Internet密钥交换用端口)，有时可能会被误报为病毒或木马。

通常我认为，只要对windows的进程有适当的认识，不依赖防病毒工具，我们仍然可以敏感的认识到异常进程或异常Dll，从而发现可疑进程，找出问题所在。
tlist这个简单的小工具就曾经帮助我发现过几个杀毒软件不能及时识别的病毒。

目前已知的和lsass相关的病毒有:
W32.HLLW.Lovgate.C@mm - Symantec Corporation
W32.Mydoom.L@mm - Symantec Corporation
W32.Nimos.Worm - Symantec Corporation
W32.Sasser.E.Worm (Lsasss.exe) - McAfee

所以大家还是应该适当的留意一下这个进程。