LSASS.EXE

[Al]

MESSAGE
the system process 'C:\windows/system32\lsass.exe'
terminated unexpectedly with status code -1073741819 the
system will now shutdown and restart.

then it gives me 60 secs till it shutsdown

I downloaded the sasser removal tool and used it and it
didn't find the sasser worm on the computer. I didn't
find it under Run in the Registry either. It has
infected 5 computers on the network and i'm out of
ideas. Please help. Thank you.

 

[Rick \Nutcase\ Rogers]

Hi Al,

This is the sasser worm, please see:

http://vil.nai.com/vil/content/v_125007.htm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A

Details on the patch needed to prevent it:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[stevev]

Not necessarily the Sasser worm...see also Microsoft Local Security
Authentication Server . However, if you are infected here is a pretty good
place to start the process of cleaning up your system.
http://ask-leo.com/archives/000114.html
or here, but they make you pay for an answer.
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_20958211.html
Type "lsass.exe" in Google and you'll find lots of info.
Good luck.

 

[Roel]

MESSAGE
the system process 'C:\windows/system32\lsass.exe'
terminated unexpectedly with status code -1073741819 the
system will now shutdown and restart.

then it gives me 60 secs till it shutsdown

I downloaded the sasser removal tool and used it and it
didn't find the sasser worm on the computer. I didn't
find it under Run in the Registry either. It has
infected 5 computers on the network and i'm out of
ideas. Please help. Thank you.

LSASS.exe is not the sasser worm, it is the LSA Server DLL that windows
uses for network authenticatin etc.

So...no work, just a normal windows program.

Regards,

Roel

 

[Rick \Nutcase\ Rogers]

Incorrect assumption. While lsass.exe is a valid Windows file, the problem
being describe IS indeed the sasser worm which affects this process. Read:

http://vil.nai.com/vil/content/v_125007.htm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A

Details on the patch needed to prevent it:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org