lsass.exe connecting to 65.205.249.108

Viruses and worms
1

When I started my computer this morning at around 6:40am, I connected to internet at 6:50am, around 7:00am my Comodo Firewall showed a window that it was learning a new process for lsass.exe connecting to 65.205.249.108.

lsass.exe is not infected, and it is in proper place C:\Windows\System32.

When I checked the ip address it shows, either MCI Communications…or…thwate.com

I have used Comodo for over 1 year, and have never seen this happen.

Also, the connection was shown for only about 2 minutes. And has not done this since.

Besides Avast!, I use Spybot S&D, along with its teatimer.exe, and Superantispyware Free Edition, and Malwarebytes’ Anti-Malware, along with using Spyware Terminator as a manual scanner for secondary choice of scanning.

2

About 2 minutes after connection established, my internet disconnected, and then reconnected. However, I have had that problem for awhile now, and even have done boot scans and results all clean.

3

I have had no virus warnings from any program in over 6 months, and have done many boot scans since 6 months ago.

4

I have Windows XP SP3. And am on a LAN Network, with one laptop XP, and home computer Windows 7. None of them have said they are infected with anything.

5

Welcome to the forums, helpmepleasewiththis. :slight_smile:

I do not think you have anything to worry about. The IP address 65.205.249.108 is related to Verisign.
See the link below.

http://www.robtex.com/dns/www.thawte.com.html

Also, is your ISP named Verizon Business? See the link below.

http://whois.domaintools.com/65.205.249.108

For more information, see the below Google search :

http://www.google.com/search?client=opera&rls=en&q=65.205.249.108&sourceid=opera&ie=utf-8&oe=utf-8

6

Thank you for the reply.

My ISP is Comcast…so I don’t understand why lsass.exe would connect to a competing company?

My concern is that when I “cmd” and “tasklist /all” lsass.exe has ProtectedStorage and SamSs…whose information I can find about those processes is that they are for account security…so why would these want to connect to the internet?

Also, I’m trying to understand what is VeriSign’s role?

7

I suggest that you check with Comcast as to why they are using Verisign to verify what.