Lsass.exe takes up too much memory

Question

My RAM is constantly at 5+ gigabyte used, most of it taken up by lsass.exe. I've already done a full system scan for virusses and malware, but found nothing.

After digging in my system logs, I did find a whole lot of errors for Schannel:

- System 
  - Provider 
   [ Name]  Schannel 
   [ Guid]  {1F678132-5938-4686-9FDC-C8FF68F15C85} 
   EventID 36887 
   Version 0 
   Level 2 
   Task 0 
   Opcode 0 
   Keywords 0x8000000000000000 
  - TimeCreated 
   [ SystemTime]  2013-04-20T01:04:43.693414200Z 
   EventRecordID 147497 
   Correlation 
  - Execution 
   [ ProcessID]  876 
   [ ThreadID]  924 
   Channel System 
   Computer Andreas-PC 
  - Security 
   [ UserID]  S-1-5-18 
- EventData 
  AlertDesc 48 

Could anyone provide me with a solution for this?

Thanks.

Answer 1

Lsass.exe is Windows' Local security authentication server. Or it's also called Local Security Authority Process. It is lsass.exe on the filesystem. It resides in *C:\Windows\System32* folder.

Check to see if the lsass.exe process on your machine that is taking up so much memory is the actual windows lass.exe in the folder I mentioned above. If not, likely it's a virus. I've never seen lsass.exe take more than 3 MB of memory.

Unfortunately, it's very nearly impossible to diagnose anything with such little information, and without actually looking at what's currently also running on your system...

This might seem like a stupid question, but are you positive no other user accounts are logged onto (but not active) on Windows? That might explain why lsass.exe was taking up so much memory, but even then... 5GB is way too much!

I would also try to match and see if you can figure out what processes are using those processIds that show up in the error logs for Schannel. That might be a good clue. You can find more about schannel here.

Hope this helps somewhat!