lsass.exe queries registry all the time

[JeanCremers]

Hello,

I'm having a problem with lsass.exe, it constantly queries the registry a few times per second, all day long. It looks like this:

2.82917997 lsass.exe:888 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Key: 0xE2BF70C8
2.82921517 lsass.exe:888 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFOVRFLOW
2.82924729 lsass.exe:888 CloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS Key: 0xE2BF70C8
2.82926797 lsass.exe:888 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Key: 0xE2BF70C8
2.82927886 lsass.exe:888 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) SUCCESS NONE
2.82929870 lsass.exe:888 CloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS Key: 0xE2BF70C8
2.82953755 lsass.exe:888 CloseKey HKLM\SECURITY\Policy SUCCESS Key: 0xE2104E30
2.82968506 lsass.exe:888 OpenKey HKLM\SECURITY\Policy SUCCESS Key: 0xE2104E30
2.82970517 lsass.exe:888 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Key: 0xE2BF70C8

I have run *several* antivirus / spyware etc. programs but have not been able to find the cure for this.

If I don't find a cure, I will want to reinstall.
Any advice please?

 

[linney]

What monitoring process is reporting this action?

Can you run the same monitoring process on another machine to confirm that this is not normal behavior of lsass.exe?

 

[mscallisto]

is this any help?

http://simple-pc-help.com/support/e...kw=lsass.exe&gclid=CJaLlZuqhJYCFQ9DgQodtWJ0Dg

also are you certain you don't have the sasser virus?

sam

 

[JeanCremers]

Hi,

This is regmon from sysinternals and no, it is not normal behaviour for lsass.
And no, it's not Lsass.
I had enough of it, I'm gonna try windows repair and else reinstall.
Thanks.

 

[JeanCremers]

I meant to say, it's not the sasser virus.

mcallisto, that regcure program report errors and then tells you have to buy it to clean them, that is no help at all, please don't advice such programs. There's enough freeware that does the same.

 

[mscallisto]

Sorry for the bad advice....you did say "Any advice please?"

sam

 

[linney]

Did you try from Safe Mode, or from Normal Mode but as a different user?

After your repair, or re-install, post back and let us know if it fixed your problem.