LSASS.EXE shuting down pc's

You may have the Sasser virus. Download the removal tool from symantec.com and run it to detect/remove the virus and then update your virus protection. If that doesn't work go to ask.com and type in lsass.exe you can find out more information there.

I ran sasser fix in safe mode it found nothing, virus files are update

I noticed you said lsass.exe, which is a W200 file. see:
http://support.microsoft.com/default.aspx?kbid=828297
for starters or do a search of Microsoft and get tons of ideas:
http://support.microsoft.com/search/default.aspx?InCC_hdn=true&Catalog=LCID%3D1033%26CDID%3DEN-US-KB%26PRODLISTSRC%3DON&withinResults=&QuerySource=gASr_Query&Product=win2000&Queryc=Lsass.exe&Query=Lsass.exe&KeywordType=ALL&maxResults=25&Titles=false&numDays=&InCC=on

It might be a differen variation of the sasser bug.
Take a computer off the network make sure it doesn't have this bug, patch it with the sasser fix (lsass.exe) and reboot, put it back on the network. If this fixed the problem then you are dealing with something that exploits the bug sasser exploited although not the sasser (or so you say).
Visit the following (Remove spaces):
http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displaylang=en

http://www.microsoft.com/security/incident/sasser.mspx

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Oh yeah, like it has been mentioned, it's a Sasser-style worm thats hitting your machine. It doesn't necessarily need to be Sasser, though. Several viruses/worms have been exploiting the same vulnerability in LSASS.EXE. Viruses like Kibuv, Bobax, Gaobot, Korgo and Explet all use this same attack method, and all would trigger a failure in LSASS.EXE. So, it could be any of them that's hitting you. Just scanning for Sasser and/or Korgo doesn't cut it.

You need the patch to prevent LSASS.EXE from being exploited in the first place to prevent all of these different viruses/worms from triggering the reboot.

Here's the link again for the patch from Microsoft:
http://tinyurl.com/37grk

hope this helps

I agree with you all about it being some type of sasser variant, but it's kicking our butt here, I tried patching one pc so far with no luck I will try a few more to see what happens, I called it quits for the night be back early in the a.m. Just to make mention we have about 6 win98 pc's they are all up and running fine, never affected. I am glad it didn't spread acroos our vlans so far it is only on 1 vlan in our other building. I'll keep ya ll updated

I experience that in our server first scan your computer for probable virus, I suggest mcafee stinger (Boot in Safe mode)then have a copy of Microsoft update in Microsoft site download Windows 2000 KB835732 update if you can copy it in your machine much better. Boot in Safe Mode, then have a copy of shutdown.exe you can have a copy in XP machine, install the Windows update. If you encounter an LSASS error execute the (shutdown -a) at run prompt. Have a copy of Zone Lab Pro in your pc to avoid this problem it acts as a firewall and I recommend it for intrusion and virus prevention...I have it can help...

When I was hit with Sasser I found that the machines being shut down weren't necessarily infected. In fact most shut downs were on 2k boxes while infections were almost entirely limited to Xp. Patch and run stinger or the microsoft removal tool on all 2k and Xp boxes. If you find a box with more than 1675 infections you can have the title.

Download all patches for winXP from Microsoft.com and install them!
That is all you need.
After that I forgot about Lsass.

Good luck.
Alexey.

This question was closed by the author