Win Server 2003 keeps rebooting?

[Daniel Hicks]

Our Windows Server 2003 Enterprise Ed. server suddenly has a problem after

about a year of operation. We login using our admin password, and get the
message:

"Shutdown initiated by NT AUTHORITY SYSTEM
c:\windows\system32\services.exe terminated unexpectedly"

You should try a Windows Server 2003-specific newsgroup. Have you looked at
the Shutdown Event Tracker?

Dan

 

[Dean J Garrett]

Our Windows Server 2003 Enterprise Ed. server suddenly has a problem after
about a year of operation. We login using our admin password, and get the
message:

"Shutdown initiated by NT AUTHORITY SYSTEM
c:\windows\system32\services.exe terminated unexpectedly"

It then reboots, and the same thing happens again... If I reboot in Safe
Mode, this doesn't happen. What can I do??? Thank you!

 

[Dean J Garrett]

Hello,

Thats interesting because my outlook newsgroup client doesn't show any
Windows Server 2003 newsgroups for msnews.microsoft.com. I wonder why??

 

[Daniel Hicks]

Thats interesting because my outlook newsgroup client doesn't show any

Windows Server 2003 newsgroups for msnews.microsoft.com. I wonder why??

Don't know, never looked for one. Perhaps try:
microsoft.public.windows.server.general

Again ... Have you looked at the Shutdown Event Tracker?

Dan

 

[Dean J Garrett]

I can't find a newsgroup specifically for Windows Server 2003, so this group
seemed to be the best suited. I'll check out the one you recommend.

Yes, I checked out the Shutdown Event Tracker, and the log entries contain
the same errors I see when the server reboots:

but I also see:

c:\windows\system32\lsass.exe terminated unexpectedly

I understand that lsass.exe is a Trojan virus, and I ran the TrendMicro
Sysclean on my server, but it didn't find the virus. I really don't know if
this is a virus problem anyway, because I can't login to the server since it
keeps shutting down.

Thanks!!

 

[Daniel Hicks]

Yes, I checked out the Shutdown Event Tracker, and the log entries contain

the same errors I see when the server reboots:


but I also see:

c:\windows\system32\lsass.exe terminated unexpectedly

I understand that lsass.exe is a Trojan virus, and I ran the TrendMicro
Sysclean on my server, but it didn't find the virus. I really don't know if
this is a virus problem anyway, because I can't login to the server since it
keeps shutting down.

LSASS.EXE is *not* a trojan virus. It is a system process, specifically
dealing with local security and login policies. There is a related worm
associated with the name lsass.exe, and this may be the cause of your
problems.

Read this information:

Discusses your problem (as best I could tell from your description)
http://www.pchell.com/virus/sasser.shtml

This article discusses the critical update from last year
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

I would recommend staying current with your updates. Perhaps automate the
process if you are unable to devote the time.

I hope this helps.

Dan