Question from Pete: Every now and then I open the Task Manager on my Windows 11 laptop and quickly scan the running processes just to make sure there’s nothing out of the ordinary running.
I hopped out of bed this morning, turned on my laptop and did one of those checks. I was surprised to see there were numerous lsass.exe processes running when there’s usually only one.
I didn’t try to count them since there were so many, but I would guess there are at least several hundred.
I know lsass.exe is a legitimate Windows process, but is it normal to have that many of them running at once?
Rick’s answer: The answer to your question is no, Pete. It isn’t normal at all to have that many lsass.exe processes running at once, especially on a home PC that isn’t connected to some type of corporate network.
My guess is those are fake lsass.exe processes that are actually malware.
There are several common Windows processes that viruses love to mimic because it makes it more difficult for casual users to identify them as malware, and lsass.exe is one of the processes that’s mimicked most often.
Here’s a very quick check you can make:
1 – Open the Task Manager and right-click on one of the numerous lsass.exe processes, then select Open file location from the menu.
2 – Check the file path to see which folder that particular lsass.exe file is located in. If it’s legitimate it should be in C:\Windows\System32. If it’s in any other location you’ll know right away that it isn’t an actual lsass.exe Windows process.
Regardless of how that quick test turns out, I recommend that you run a thorough series of virus and malware scans, starting with your laptop’s installed antivirus app.
If that scan comes up clean, try running scans with at least two or three of the on-demand “second opinion” scan engines listed in this post.
I hope this helps, Pete. Good luck!
Update from Pete: It was a virus. I used your instructions to check the file location for several of the processes and they appear to be scattered all over the hard drive.
I ran a scan with McAfee and it found a few of them. Then I ran another scan with Malwarebytes and it found several more.
Now things are back to normal when I make my checks with the Task Manager. Thanks for your help.