Winsock2 and Lsass.exe error message on shut down

[Loki]

Hi All,

System Config = P4 2.8m, WinXp Pro SP2 fully updated with .Net 1.1 sp1.
Norton AV and Firewall.

I have been having a problem for some weeks now which I cannot attribute to
any system changes etc.

On shut down I receive the shutting down screen then a pop up message saying
"The instruction at 0x00000000 referrenced memory at 0x00000000. The memory
could not be read. Click OK to terminate. Click OK to cancel." The pop
up is entitled Lsass.exe application. My initial thoughts were sasser or
doom variant worm but I have run fixes and detection which did not find
anything.

I have tracked the error down to the winsock2 registry settings (I believe
that is where it might be anyway) I have deleted the winsock2 settings and
I get no message, restored the basic XP2 settings from another machine and
the message reappears which leads me to believe I have a corrupted file
referrenced in the namespace or protocol catalogs.

Has anyone come across this error message under similar circumstances or
could anyone suggest a way to isolate the file which may be causing a
problem. Or am I barking up the wrong tree??

I would appreciate any help you can give.

many thanks.

Loci

 

[Guest]

Yes, I've been getting the same, very annoying!, popup advisory. I haven't
been able to isolate it either. I've done system restore but no joy. I
believe it may be coming from my wireless LAN configuration as I've been
trying to get THAT bastard to work for a couple weeks now. It had been okay
for the longest time but for some reason it began dropping the connection.

I have the WAP-PSK encryption enabled but perhaps inhibiting the firewall &
Norton antivirus may have let something sneak in? I ran WinTools.net to
clean up my files & registry and even found a file (can't remember the name)
with SpyBot but I'll be darned if I didn't get the same freakin' error
advisory again!!

Can anyone out there give us some insight??

 

[Loki]

Brentromero,

Ok a little further investigation reveals the following:

the namespace catalog references mswsock.dll, winrnr.dll and nwprovau.dll
all found in the system32 folder.

the protocol catalog references mswsock.dll and rsvpsp.dll.

After checking all the file information all seem ok except for the
mswsock.dll which reads created 23 Aug 2001, modified 4 Aug 2004 last
accessed 24 Aug 2005. WinXP SP 2 mswsock.dll info reads created 4 Aug 2004.
I am going to replace the file in use with the winxp sp2 file to see if that
makes a difference. I have checked out the rsvpsp.dll which is added when
..Net is installed and that didn't stop the message. i.e. Uninstaled .Net
and removed the reference.

Will let you know if mswsock.dll replacement makes a difference if not I
will try replacing the winrnr.dll and nwprovau.dll.

Out of curiosity what info does your mswsock.dll give date wise?

Loki

 

[Loki]

Brentromero

I have replaced all the dll's referred to in my earlier post no change.

Not sure what to do next, are there any MVP's with any good ideas as to what
would be a good course of action to take at this point?

Thanks for any assistance.

Loki