Unexpected Shutdown

[Matt Bates]

One of the PC's in a dial-up office is acting rather
strangely!

When they connect to our system via the internet/citrix,
they receive a message box after about 5-10 minutes. the
message reads something like:
"
System Shutdown
Authorised NT Authority Systems
C:/WINIT/SYSTEM32

LSASS.exe Terminated Unexpectedly
Status Code 128
"

once this message box appears they have about 30 seconds
before the PC shutsdown.

does anyone have any ideas about how to solve this?

 

[Alias]

Sounds like the Sasser worm to me.

Alias

 

[Torgeir Bakken \(MVP\)]

One of the PC's in a dial-up office is acting rather
strangely!

When they connect to our system via the internet/citrix,
they receive a message box after about 5-10 minutes. the
message reads something like:
"
System Shutdown
Authorised NT Authority Systems
C:/WINIT/SYSTEM32

LSASS.exe Terminated Unexpectedly
Status Code 128
"

once this message box appears they have about 30 seconds
before the PC shutsdown.

Hi

Most likely caused by the Sasser worm:

http://www.microsoft.com/technet/Security/alerts/sasser.mspx

 

[charles kuchar]

I had that problem several months ago from another worm that had infected
another computer in the office. It kept banging the server trying to infect
it and finally it would reboot every 5 or 10 minutes... Or as they say, it
might be the sasser worm.. regardless, do some checking...