how to resolve shutdown that initiated by NT Authority/system

Yeah, definately sasser.

It does sound like the Sasser Worm.  At the command prompt type "shutdown -a".  This will prevent the system from shutting down.  Then I would recommend searching Google for a fix.  You should probably also update your anti-virus software.  

i have a AV software "Microsoft Forefront Security" found no sasser or blaster worm, run rootkit "revealer rootkit" delete some but don't really know what else to delete. run sasser and blaster fix tool no worms were found. Run Hijackthis don't know what check in order to fix.

My OS Server 2003.

When type shutdown -a users can't access the network, I can open active directory etc..

Try malwarebytes from www.malwarebytes.org

I try what you propose but no malicious items were detected

Is the server patched up to date? I have seen a similar problem caused by AV software so make sure your server has Server 2003 SP2 and make sure forefront is completely up to date.

Do you get any other error messages? is there an error code when lsass crashes?

Any recent software changes? Updates, new programs, etc

nop just add some updates.

The server has Server 2003 SP2 Standard Edition, Forefront is up to date.
The error code:
"This system is shutting down. please save all work in progress and logg off. any unsaved changes will be lost. This shutdown was initiated by NT Authority/system.
the system process 'C:\windows/system32\lsass.exe' terminated unexpectedly with status code -1073741819 the system will now shutdown and restart"

Any change you can install SP3?

http://www.microsoft.com/downloads/details.aspx?FamilyId=95AC1610-C232-4644-B828-C55EEC605D55&displaylang=en

See if you have this hotfix installed: http://support.microsoft.com/kb/893246

when I click on it it shows SP2

How long is the server up before you get the error? If it is up for some time you could try disabling the AV software to see if this is the cause. Do you have any other applications running?

I think  since I have installed forefront i start to have LSA Shell error that restarts the computer once a day until I get this error describes above where the server restarts itself every five mns. and when I type "shutdownn -a" it didn't restart but i can't access to active directory and some other important components.

Let's try to desinstall forefront.

Sorry, I thought SP3 was available.

the hotfix 893246 is older than what I have on the serer

When I'm trying to desinstall forefront I receive a "fatal error during installation"

Hmmmm. I would disable the AV services, reboot the server then try again.

After Restarting the Server I was able to desinstall forefront i just have the same error so i'm restarting again

Lsass is responsible for several different system services. Have you tried looking through the event log for more specific errors?

There is really nothing specific the errors I have in Event viewer are: Winlogon ID 1015, LoadPerf ID 3011, Service control Manager ID 7000, 7038,8003, 7003, Win32 ID 29 that's all

hellooooooooo

Can you post your hijackthis log here please?

Also, try combofix http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:16 AM, on 6/16/2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Dfssvc.exe
C:\WINDOWS\System32\dns.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\ismserv.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINDOWS\system32\ntfrs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\oobechk.exe
C:\WINDOWS\system32\mshta.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [ShutdownEventCheck] %systemroot%\system32\dumprep 0 -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User '?')
O4 - HKUS\S-1-5-21-1314936129-2815895391-1036861029-2797\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O15 - ESC Trusted Zone: http://view.atdmt.com
O15 - ESC Trusted Zone: http://www.bleepingcomputer.com
O15 - ESC Trusted Zone: http://googleads.g.doubleclick.net
O15 - ESC Trusted Zone: http://www.eggheadcafe.com
O15 - ESC Trusted Zone: http://www.eventid.net
O15 - ESC Trusted Zone: http://images.experts-exchange.com
O15 - ESC Trusted Zone: http://www.experts-exchange.com
O15 - ESC Trusted Zone: http://www.freedomlist.com
O15 - ESC Trusted Zone: http://pagead2.googlesyndication.com
O15 - ESC Trusted Zone: http://bleepingcomputer.us.intellitxt.com
O15 - ESC Trusted Zone: http://images.intellitxt.com
O15 - ESC Trusted Zone: http://edge.quantserve.com
O15 - ESC Trusted Zone: http://forums.techarena.in
O15 - ESC Trusted Zone: http://m.webtrends.com
O15 - ESC Trusted IP range: http://66.129.67.103
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240388948921
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = concern.net
O17 - HKLM\Software\..\Telephony: DomainName = concern.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE843F10-D78F-4DC8-9F5D-BEECD9BFBDD3}: NameServer = 10.1.162.3,10.1.0.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = concern.net
O23 - Service: WTNGEW - Sysinternals - www.sysinternals.com - C:\DOCUME~1\BARRYR~1.ADM\LOCALS~1\Temp\WTNGEW.exe
O23 - Service: ZSIM - Sysinternals - www.sysinternals.com - C:\DOCUME~1\BARRYR~1.ADM\LOCALS~1\Temp\ZSIM.exe

--
End of file - 4147 bytes

The last 2 entries (023) make me nervous. NOTHING should run from a temp directory.

so what do you suggest

combofix doesn't work on Server 2003

I would backup those last 2 and remove them

They refer to the rootkit revealer tool so i think i can delete them

i  remove them

no change?

nop nothing

no more ideas?

Nothing from me. Sounds like you have a corrupt OS install. You have no virus' and no malware.  Maybe try a repair install of the OS?

can you run SFC /SCANNOW from the run prompt?

helloooooooooooo

hi?

no more comments about my issue?