Solved

C:\WINNT\System32\lsass.exe Code 128

Posted on 2004-08-19
5
30,544 Views
Last Modified: 2010-08-05
I'm running W2K Pro on a Dell Optiplex.  I recently installed a new primary hard drive and a clean copy of W2K Pro.  The only other installation was the Intel chipset from the Dell Resource CD.  I keep getting a dialogue box with the following message: "The system process C:\WINNT\System32\lsass.exe terminated unexpectedly with status code 128."  The system shuts down and restarts.  Can anyone tell me what I need to fix, and how I need to fix it?  (I'm a data person, not an IT pro. So, you need to walk me through it.)  Thanks.
0
Comment
Question by:DocPit
  • 3
5 Comments
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 500 total points
Comment Utility
Hello DocPit =)

What You Should Know About the Sasser Worm and Its Variants:
http://www.microsoft.com/security/incident/sasser.asp

Apply MS Security Bulletin:
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

Use One of the Following Removal Tools to Delete the Virus:
======================================
1) Sasser (A-F) Worm Removal Tool (KB841720) >> http://www.microsoft.com/downloads/details.aspx?familyid=76C6DE7E-1B6B-4FC3-90D4-9FA42D14CC17&displaylang=en

2) FxSasser.exe.from Symantec >> http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

3) Stinger from McAfee >> http://vil.nai.com/vil/stinger/

4) SysClean PACKAGE from TrendMicro >> http://www.trendmicro.com/download/dcs.asp

5) SASSGUI\SASSSFX from Sophos >> http://www.sophos.com/support/disinfection/sasser.html

6) ClnSasser from Computer Associates >> http://www3.ca.com/Files/VirusInformationAndPrevention/clnsasser.zip

7) F-Sasser from F-Secure >> http://www.f-secure.com/tools/f-sasser.zip

8) SasserFix2 from Norman >> http://www.norman.com/Virus/Virus_removal_tools/14938

9) QuickRemover from Panda >> http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?lst=sol&idvirus=46865
---------------------------------------------------------
NOTE: plzz see the Relevant Sites for FULL Instructions on Removal in the First Link Before using the Tools

!! GOOD LUCK !!
0
 
LVL 3

Expert Comment

by:saito1
Comment Utility

good answer SheharyaarSaahil
there is nothing to add more ;-)
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
lol.... thanx saito :D
0
 

Author Comment

by:DocPit
Comment Utility
Thanks Sheharyaar,

Just a note: The MS site returned a message: "No infection found."  The Symantec site abended the process.  However, the McAfee site found and deleted the virus (W32/Sdbot.worm.gen).
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
that's why i love Mcafee ;-)
Glad u got rid of that nasty virus !!!!

Cheers ^_^
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
windows 2000 3 420
Windows 2000 Server to 2008 upgrade 8 506
Kill system process in windows 2000 10 182
DNS server query - zone verus cache 5 150
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now