lsass.exe terminated unexpectedly with status code 128?

[Todd]

I get the following error message at random times:

"The system is shutting down. Please save all work in
progress and log off. Any unsaved changes will be lost.
The shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: 00:00:59

Message
The system process
'C:\WINNT\system32\lsass.exe' terminated unexpectedly with
status code 128. The system will now shut down and
restart"

Then it shuts down. This is very annoying. It started
out of nowhere today and has happened a few times.

I am running 2000 pro with service pack 4.

Any help with be greatly appreciated.

 

[Guest]

run all the updates...........

 

[Cindy]

I have been having computer problems the past
few days. It only happens when I am hooked up to my router and cable
modem at home. I ran all day at work (well until I had to leave to
get my crown in) today and yesterday with no problem. I assume work
has a much better firewall than is present in my router. Well it
appears theres yet another security leak in windows. BIG SUPRISE
(big eyeroll here). After 2 days of searching I found that I needed
an update. I applied and everything appears ok now. Before I
couldn't be on more than 20 minutes and have the computer shut down
with this message:



System Shutdown This system is shutting down. Please save
all work in progress and log off. Any unsaved changes will
be lost. This shutdown was initiated by \

Time before shutdown: 00:00:59

Message

The system process 'C:\WINNT\System32\Lsass.exe'
terminated unexpectedly with status code 128. The system
will now shut down and restart



This update from microsoft appears to have fixed it:

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

Heres some info on it:

http://www.eeye.com/html/Research/Advisories/AD20040413C.html
http://isc.sans.org/diary.php?date=2004-04-26

I would advise anyone running windows to go to the first link to get
the appropriate fix. It appears someone out there is taking
advantage of this security leak and trying to gain control of random
pcs.

Cindy

 

[Peter van der Woude]

McAfee identifies this as the WM32/Sasser.worm
http://vil.nai.com/vil/content/v_125007.htm

Peter