LSASS.EXE

  • Thread starter Thread starter Al
  • Start date Start date
A

Al

MESSAGE
the system process 'C:\windows/system32\lsass.exe'
terminated unexpectedly with status code -1073741819 the
system will now shutdown and restart.

then it gives me 60 secs till it shutsdown

I downloaded the sasser removal tool and used it and it
didn't find the sasser worm on the computer. I didn't
find it under Run in the Registry either. It has
infected 5 computers on the network and i'm out of
ideas. Please help. Thank you.
 
MESSAGE
the system process 'C:\windows/system32\lsass.exe'
terminated unexpectedly with status code -1073741819 the
system will now shutdown and restart.

then it gives me 60 secs till it shutsdown

I downloaded the sasser removal tool and used it and it
didn't find the sasser worm on the computer. I didn't
find it under Run in the Registry either. It has
infected 5 computers on the network and i'm out of
ideas. Please help. Thank you.

LSASS.exe is not the sasser worm, it is the LSA Server DLL that windows
uses for network authenticatin etc.

So...no work, just a normal windows program.

Regards,

Roel
 
Incorrect assumption. While lsass.exe is a valid Windows file, the problem
being describe IS indeed the sasser worm which affects this process. Read:

http://vil.nai.com/vil/content/v_125007.htm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A

Details on the patch needed to prevent it:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org
 
Back
Top