Jump to content

Netstat showing that lsass.exe/1sass.exe is connecting to pornhub?


Recommended Posts

Hello, I'm new to the forum so excuse if this post is not in the correct place but i really need some help on this one..

My fathers computer has been running terribly slow and he says it's been turning off and restarting and just acting strange. 

So i figured i can run malwarebytes + other virus scanners, CCleaner, clear his cache and cookies and web history and i figured that would do the trick but after i did all the troubleshooting, the same symptoms are appearing. So i pulled up netstat and I found out his computer is connecting to pornhub.com via firefox sessions( which aren't open) and 1sass.exe appears to be the one that's opening them?

I've tried scanning with multiple antivirus programs, tried different firewalls.

I tried going through command prompt to delete the file but it woudln't allow me to do so.

I've attached a screenshot. What should i do?

Thank you


Link to post
Share on other sites

Hello zenoj and welcome to Malwarebytes,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.

Thank you,


Link to post
Share on other sites

Hello zemoj,

There are no other options, the logs need to be either copy/pasted or attached to your reply. Without full logs I cannot analyze and produce a "fix" I understand your concerns, please be aware that there are hundreds of logs posted here every week without as much as a second thought. Log contents will not make you prone to any other issues or concerns....

Thank you,


Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.



Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.