General discussion

Locked

LSASS.EXE shuting down pc's

By BobbyJGR ·
HELP I have windows 2000 pc's and Windows XP machines and the problem is I am getting a message from Winnt\authority saying something about lsass.exe and code128 and the pc will reboot in 55 seconds. If I take the pc off the network it boots up and stays up. I have run the sasser fix tool from Symantec and the Koberg tool from Symantec neither one found anything. Or Symantec Corp Edition virus definitions are up to date and scanning the pc finds nothing.
Any Ideas.
P.S. As soon as we put the pc back on the network we get the message and the pc reboots
Thanks ahead of time

This conversation is currently closed to new comments.

17 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by Bratt In reply to LSASS.EXE shuting down pc ...

You may have the Sasser virus. Download the removal tool from symantec.com and run it to detect/remove the virus and then update your virus protection. If that doesn't work go to ask.com and type in lsass.exe you can find out more information there.

Collapse -

by Bratt In reply to

Here is a great website to start your search try this website. I hope this helps.
http://www.reger24.de/prozesse/LSASS.EXE.php
I would be interested to know the outcome.

Collapse -

by BobbyJGR In reply to

Poster rated this answer.

Collapse -

by BobbyJGR In reply to LSASS.EXE shuting down pc ...

I ran sasser fix in safe mode it found nothing, virus files are update

Collapse -

by BobbyJGR In reply to

Thank you all we now have the problem under control, looks like we had 2 we had a new variant of Backdoor.Nibu and the W32.Explet.a. Also installed all critiacal updates

Collapse -

by BobbyJGR In reply to

Poster rated this answer.

Collapse -

by pierrejamme In reply to LSASS.EXE shuting down pc ...

I noticed you said lsass.exe, which is a W200 file. see:
http://support.microsoft.com/default.aspx?kbid=828297
for starters or do a search of Microsoft and get tons of ideas:
http://support.microsoft.com/search/default.aspx?InCC_hdn=true&Catalog=LCID%3D1033%26CDID%3DEN-US-KB%26PRODLISTSRC%3DON&withinResults=&QuerySource=gASr_Query&Product=win2000&Queryc=Lsass.exe&Query=Lsass.exe&KeywordType=ALL&maxResults=25&Titles=false&numDays=&InCC=on

Collapse -

by BobbyJGR In reply to

Poster rated this answer.

Collapse -

by shmaltz In reply to LSASS.EXE shuting down pc ...

It might be a differen variation of the sasser bug.
Take a computer off the network make sure it doesn't have this bug, patch it with the sasser fix (lsass.exe) and reboot, put it back on the network. If this fixed the problem then you are dealing with something that exploits the bug sasser exploited although not the sasser (or so you say).
Visit the following (Remove spaces):
http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displaylang=en

http://www.microsoft.com/security/incident/sasser.mspx

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Collapse -

by BobbyJGR In reply to

Poster rated this answer.
Could not access this site

Back to Windows Forum
17 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums