Windows LSASS.EXE Problem

Posted on 2004-08-04
Last Modified: 2010-04-13

I am running WIndows 2000 Professional Service PAck 4 and i'm having trouble with the LSASS.exe process. The computer is on my windows 2000 network. it is a basic client machine with no special features.

Before i describe it i have checked lots of sites that describe various types of problems that can arise with the LSASS process. I have tried lots of the fixes also.

Basically when the computer starts up it gets as far as the logon screen and a popup box appears that tells me the lsass.exe process has referenced memory that could not be read and will be shut down. if i click on ok i get a dialog box telling me that the system is being rebooted and i am given 60 seconds. this is all before i even try to login.

if i try to login in now i dont get to the username and password screen. it keeps returning to the 'press ctrl-alt-delt' screen.

If i ignore the initial popup box(referenced memory error) and try to login i get to the username/ password entry screen. however if it try to login as a network user i get error messages telling me the system couldn't locate that handle.

i am however able to login as the local administrator of the machine. the popup box stay on screen and if i click ok it shuts the machine down after the 60 second period.

i checked the event logs and theres no real information in there other than a note that it showed a popup.

i am running Trend Micro anti-virus with the firewall enabled and the virus definition files are bang up to date. they were up to date before this occurred. I ran a fulll system scan and it didnt find anyting.

i downloaded the sasser removal tool from symantec and it didnt find anything.

i am running service pack 4 which, as far as i am aware, patches the vulnerability.

i installed the hard drive as a slave on another machine and copied the LSASS.exe file across. but no joy!

has anyone got any ideas on how to get around this???????
Question by:Fatlog
  • 4
  • 2
  • 2
LVL 28

Expert Comment

ID: 11714873
The system will shut down if LSASS has a terminal problem. It is telling you that it is experiencing a memory error - have you tried a different stick of RAM? The boot process will heavily load the RAM, so if an error is going to occur, this is the likely time.

Chris B

Author Comment

ID: 11715045
as in not enough memory or the current memory module is not working properly?

Author Comment

ID: 11715080
the machine has two memory sticks. i tried each one on its own and the same problem still occurred. could the problem be with both?
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

LVL 28

Expert Comment

ID: 11715369
<could the problem be with both?> Probably not - sorry, it was worth a try.

Chris B

Author Comment

ID: 11715457
any other ideas?

i tried installing the service  pack again but you guessed it, nada!

bloody annoying!

there must be a reason for it!

Accepted Solution

RevelationCS earned 100 total points
ID: 11716011
Have you done an online scan for virus infections?

Try the following:

Adaware -
Spybot S&D -
Trend Antivirus Online Scanner -

Make sure you have Adaware and Spybot updated before running the scans with them. Also, download HijakThis and post the log file here.

Author Comment

ID: 11717364
thanks revelationCS - worked a treat.

not sure which one of Adaware or Spybot cleaned it but its working now.

should my anti-virus software not have picked it up as a treat???

Expert Comment

ID: 11717510
glad I could help you out....

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Active directory user account audit 4 731
Application Deployment - Simple 7 647
schedule script execution in windows 2000 3 133
Change port for terminal servers (2000 and 2003) 3 157
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This tutorial shows how to create a greeting card by combining two image layers and a text layer on a PC using a free image editing app.
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question