lsass.exe error

[AlexDewar]

Whenever i turn on my computer and get to the logon screen, i get a message
saying:

" System shutdown

The system is shutting dowm. Please save all work and log off. The shutdown
wa s initiated by \

Time before shutdown: 00:00:59 [this counts down to 0]

-Message-
The system process 'C\WINDOWS\system32\lsass.exe' terminated unexpectedly
with status code 1073741819. This system will shutdown and restart. "




When i press control-alt-del and type in my username to log in, it just
comes up with

"System could not log you in due to the following error:

The handle is invalid."



My disc drive does not work so i cannot boot from the windows cd. I tried
changing the BIOS time (according to wikipedia), but this didn't help.

Any ideas?

 

[Falco]

Whenever i turn on my computer and get to the logon screen, i get a
message saying:

" System shutdown

The system is shutting dowm. Please save all work and log off. The
shutdown wa s initiated by \

Time before shutdown: 00:00:59 [this counts down to 0]

-Message-
The system process 'C\WINDOWS\system32\lsass.exe' terminated
unexpectedly with status code 1073741819. This system will shutdown
and restart. "




When i press control-alt-del and type in my username to log in, it
just comes up with

"System could not log you in due to the following error:

The handle is invalid."



My disc drive does not work so i cannot boot from the windows cd. I
tried changing the BIOS time (according to wikipedia), but this
didn't help.

Any ideas?

Try this link: http://www.cybertechhelp.com/forums/showthread.php?t=35031

Or this one: http://support.microsoft.com/kb/321024

Or try googling [1]: lsass.exe' terminated unexpectedly

Or try googling [2]: status code 1073741819

Just for starters

 

[John John - MVP]

Sounds suspiciously like the now somewhat ancient W32.Sasser.Worm.

http://vil.nai.com/vil/content/v_125007.htm
W32/Sasser.worm.a

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050116-1831-99
W32.Sasser.Worm | Symantec

A bit hard to get this worm in this day and age, any computer that is
properly patched and properly protected by a firewall or sitting behind
a NAT router should be pretty well immune from this pest.

John

 

[Peter Foldes]

Alex

Sorry to say but most probably a Sasser. See the following

http://www.askdavetaylor.com/lsassexe_system_error_every_time_i_boot_windows.html

 

[Jose]

Whenever i turn on my computer and get to the logon screen, i get a message
saying:

" System shutdown

The system is shutting dowm. Please save all work and log off. The shutdown
wa s initiated by \

Time before shutdown: 00:00:59 [this counts down to 0]

-Message-
The system process 'C\WINDOWS\system32\lsass.exe' terminated unexpectedly
with status code 1073741819. This system will shutdown and restart. "

When i press control-alt-del and type in my username to log in, it just
comes up with

"System could not log you in due to the following error:

The handle is invalid."

My disc drive does not work so i cannot boot from the windows cd. I tried
changing the BIOS time (according to wikipedia), but this didn't help.

Any ideas?

Go ahead and logon before the countdown finishes, then click Start,
Run and in
the box enter:

shutdown -a

That will abort the shutdown, then fix your Sasser infection.

 

[AlexDewar]

Ok thanks for the replies everyone. I think it is this Sasser thing. I don't
know how I caught it since i have antivirus, windows update should be
working, although i don't personally use this pc much so I'm not sure.

Go ahead and logon before the countdown finishes, then click Start,
Run and in
the box enter:

shutdown -a

That will abort the shutdown, then fix your Sasser infection.

The problem is that I can not log on - it comes up with the logon on screen,
which *does not* have the usual users to click on, is just blank. Therefore I
can not log on, and just shuts down after 60 seconds. If i try logging on by
pressing con-alt-del and type in my username, then it comes up with "System
could not log you in due to the following error: The handle is invalid."

All the solutions like start>run>shutdown -a, and using a Sasser removal
tool involve being actually logged on.

I don't really know what I am talking about here, but is there any way to
modify the registry or something without using windows... I i know that may
sound stupid.

Any ideas any one?

 

[Jose]

Ok thanks for the replies everyone. I think it is this Sasser thing. I don't
know how I caught it since i have antivirus, windows update should be
working, although i don't personally use this pc much so I'm not sure.

The shutdown -a isn't the only option, but sometimes easier.

Windows Update will not protect you from malicious software and there
is no single anti-software that knows about everything so sometimes
bad things will get through.

It doesn't matter much how you got it, so speculation is a waste of
time. You just need to fix it.

You need to boot the XP Recovery Console using either a genuine XP
bootable installation CD or if you do not have one, create a bootable
Recovery Console CD.

After you get Recovery Console booted, we can resolve the issue.

You can make a bootable Recovery Console CD by downloading an ISO file
and burning it to a CD.

The bootable ISO image file you need to download is called:

xp_rec_con.iso

Download the ISO file from here:

http://www.mediafire.com/?ueyyzfymmig

Use this free and easy program to create your bootable CD:

http://www.imgburn.com/

It would be a good idea to test your bootable CD on a computer that is
working.

You may need to adjust the computer BIOS settings to use the CD ROM
drive as the first boot device instead of the hard disk. These
adjustments are made before Windows tries to load. If you miss it,
you will have to reboot the system again.

When you boot on the CD, follow the prompts:

Press any key to boot from CD...

The Windows Setup... will proceed.

Press 'R' to enter the Recovery Console.

Select the installation you want to access (usually 1: C:\WINDOWS)

You may be asked to enter the Administrator password (usually empty).

You should be in the C:\WINDOWS folder. This is the same as the C:
\WINDOWS folder you see in explorer.

Report back when you are in the Recovery Console.