[Stoffer]

I was playing Age of empires 2 over the internet through the zone. After finishing a game i return to the lobby.
Suddenly my firewall pops up and tell that an application called

LSA Executable and Server DLL (Export Version)

is asking for server rigths.

I clicked "no" cause i didnt know the program.

Do anybody know what it is and is it ok to allow it to get on the net.
I dont think its a virus cause i have norton auto-protect running in the background and it havent complained.
BTW, im using fully updated win2k.

[Jerry Atrik]

i didnt find it in the symantec security response
may be sorta a spyware
what in/out ports is it looking for
could just be a loopback

[Stoffer]

Well im quite sure it aint spyware. I looked for more info in zonealarm and it came up with this:

http://pralerts.zonelabs.com/pralerts/pr...0f023f87c5e0f71

I also ran adaware just after without any results. After that i made a viruscheck and nothing got detected.
Im not very concerned i was just wondering what that program were. I mean it could be some sort of Microsoft spyware watching what u are doing.

[CUViper]

If you look under task manager, you will see it as lsass.exe. I found these descriptions on Microsoft's site:

Quote:

This is the local security authentication server, and it generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.

Quote:

Local Security Administration Subsystem, the process running the Local Security Authority component of the Windows NT Security Subsystem. This process handles aspects of security administration on the local computer, including access and permissions. The Net Logon service shares this process.

[Stoffer]

Yeah i found it in my Task manager. Would it be safe to allow it connection or shouldnt I allow it???

[Jerry Atrik]

yes those are loopbacks