Windows LSASS.EXE Problem
Posted on 2004-08-04
I am running WIndows 2000 Professional Service PAck 4 and i'm having trouble with the LSASS.exe process. The computer is on my windows 2000 network. it is a basic client machine with no special features.
Before i describe it i have checked lots of sites that describe various types of problems that can arise with the LSASS process. I have tried lots of the fixes also.
Basically when the computer starts up it gets as far as the logon screen and a popup box appears that tells me the lsass.exe process has referenced memory that could not be read and will be shut down. if i click on ok i get a dialog box telling me that the system is being rebooted and i am given 60 seconds. this is all before i even try to login.
if i try to login in now i dont get to the username and password screen. it keeps returning to the 'press ctrl-alt-delt' screen.
If i ignore the initial popup box(referenced memory error) and try to login i get to the username/ password entry screen. however if it try to login as a network user i get error messages telling me the system couldn't locate that handle.
i am however able to login as the local administrator of the machine. the popup box stay on screen and if i click ok it shuts the machine down after the 60 second period.
i checked the event logs and theres no real information in there other than a note that it showed a popup.
i am running Trend Micro anti-virus with the firewall enabled and the virus definition files are bang up to date. they were up to date before this occurred. I ran a fulll system scan and it didnt find anyting.
i downloaded the sasser removal tool from symantec and it didnt find anything.
i am running service pack 4 which, as far as i am aware, patches the vulnerability.
i installed the hard drive as a slave on another machine and copied the LSASS.exe file across. but no joy!
has anyone got any ideas on how to get around this???????