Solved: Okay, now I'm scared -- lssas.exe

[leneal]

I'm having no problems with my pc or OS (XP SP2), but by happenstance this morning, I checked the processes tab in AVG Anti-spyware and noticed lssas.exe.

I ran a quick Google search and saw lots of references to this as a serious trojan. I ran all of my spyware apps (AVG Anti-spyware, Spybot S&D, Spyware Terminator, Ad-Aware), and none of them register it as a problem. (I'm not sure whether or not I'm naive to rely on free apps, but I've always been careful and had thus far been successful in avoiding trojans.)

I went back to the AVG A-S and tried to terminate the process. I then got a message that windows\system32\lssas.exe was unexpectedly terminated with status 0, and got a countdown to a reboot.

Okay, now I'm scared. Is this a legit process that scare-marketing has misled me on, or is this a serious infection? Any insights or advice?

 

[leneal]

I'm a little surprised that no one has responded yet. Does that mean my question is too dumb to answer?

If anyone has a similar concern and happens across this post, this is what I've gleaned thus far. There is both a legitimate process and a nasty trojan of the same name. Apparently, if the file is located in the c:\windows\system32 folder, it's legit. (It's related to user logon.) If elsewhere, you have a serious problem. It is infuriating how the scare-marketing of security software likes to gloss over that detail.

Until I hear otherwise, I'm assuming I got it right. If anyone know differently, please weigh in!