Lsass.exe terminated unexpectedly with status code 128

[Greg Crowe]

Suddenly, all of the machines logged into our network are,
at apparently random intervals, generating a shutdown
window with the following:

"The system is shutting down. Please save all work in
progress and log off. Any unsaved changes will be lost.
This shutdown was initiated by NT AUTHORITY\SYSTEM.

The system process C:\WINNT\System32\lsass.exe terminated
unexpectedly with status code 128. The system will shut
down and restart."

Since this is not happening when the machines are booting
undocked, I am guessing that this is a problem with my
domain controller, or something. I made sure the server
has SP4, but it still keeps happening.

What do I need to do?

 

[Greg Crowe]

Nevermind, this appears to be another virus. Sorry for the
bandwidth expenditure.

 

[Greg Crowe]

Even though the initial problem may have been caused by a
virus, I have scanned every system an the virus us not
present, and the removal tool doesn't find anything
either. Yet I am still having this problem, and don't know
how to fix it. I even tried re-installint the OS on a
client machine, but that didn't help.

If anyone has any ideas, please help.

 

[John]

Try this:
http://www.microsoft.com/security/incident/sasser.asp