I have a win server. Its very slow and when I opened task manager to see what process took CPU, I saw that lssar.exe use all of it. Immediately I have been run my antivirus program, but nothing was found. Any way my server is useless now and my network has a problem. What should I do?
Lsass.exe is regular win process and its in system files. If its not there, then its worm called Sasser. But, I think that you havent problem with worm (if you do have a sasser, your computer would reboot every 60 seconds). I think the problem is a lot of users in administrators group. To solve this problem, restrict the number of them.