Solved

Windows LSASS.EXE Problem

Posted on 2004-08-04
8
1,312 Views
Last Modified: 2010-04-13
Hi,

I am running WIndows 2000 Professional Service PAck 4 and i'm having trouble with the LSASS.exe process. The computer is on my windows 2000 network. it is a basic client machine with no special features.

Before i describe it i have checked lots of sites that describe various types of problems that can arise with the LSASS process. I have tried lots of the fixes also.

Basically when the computer starts up it gets as far as the logon screen and a popup box appears that tells me the lsass.exe process has referenced memory that could not be read and will be shut down. if i click on ok i get a dialog box telling me that the system is being rebooted and i am given 60 seconds. this is all before i even try to login.

if i try to login in now i dont get to the username and password screen. it keeps returning to the 'press ctrl-alt-delt' screen.

If i ignore the initial popup box(referenced memory error) and try to login i get to the username/ password entry screen. however if it try to login as a network user i get error messages telling me the system couldn't locate that handle.

i am however able to login as the local administrator of the machine. the popup box stay on screen and if i click ok it shuts the machine down after the 60 second period.

i checked the event logs and theres no real information in there other than a note that it showed a popup.

i am running Trend Micro anti-virus with the firewall enabled and the virus definition files are bang up to date. they were up to date before this occurred. I ran a fulll system scan and it didnt find anyting.

i downloaded the sasser removal tool from symantec and it didnt find anything.

i am running service pack 4 which, as far as i am aware, patches the vulnerability.

i installed the hard drive as a slave on another machine and copied the LSASS.exe file across. but no joy!

has anyone got any ideas on how to get around this???????
0
Comment
Question by:Fatlog
  • 4
  • 2
  • 2
8 Comments
 
LVL 28

Expert Comment

by:burrcm
Comment Utility
The system will shut down if LSASS has a terminal problem. It is telling you that it is experiencing a memory error - have you tried a different stick of RAM? The boot process will heavily load the RAM, so if an error is going to occur, this is the likely time.

Chris B
0
 

Author Comment

by:Fatlog
Comment Utility
as in not enough memory or the current memory module is not working properly?
0
 

Author Comment

by:Fatlog
Comment Utility
the machine has two memory sticks. i tried each one on its own and the same problem still occurred. could the problem be with both?
0
 
LVL 28

Expert Comment

by:burrcm
Comment Utility
<could the problem be with both?> Probably not - sorry, it was worth a try.

Chris B
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:Fatlog
Comment Utility
any other ideas?

i tried installing the service  pack again but you guessed it, nada!

bloody annoying!

there must be a reason for it!
0
 
LVL 8

Accepted Solution

by:
RevelationCS earned 100 total points
Comment Utility
Have you done an online scan for virus infections?

Try the following:

Adaware - http://www.lavasoftusa.com/software/adaware/
Spybot S&D - http://www.safer-networking.org/en/download/index.html
Trend Antivirus Online Scanner - http://housecall.trendmicro.com

Make sure you have Adaware and Spybot updated before running the scans with them. Also, download HijakThis and post the log file here.
0
 

Author Comment

by:Fatlog
Comment Utility
thanks revelationCS - worked a treat.

not sure which one of Adaware or Spybot cleaned it but its working now.

should my anti-virus software not have picked it up as a treat???
0
 
LVL 8

Expert Comment

by:RevelationCS
Comment Utility
glad I could help you out....
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This article explains how to prepare an HTML email signature template file containing dynamic placeholders for users' Azure AD data. Furthermore, it explains how to use this file to remotely set up a department-wide email signature policy in Office …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now