Solved

lsass.exe exits with error code 120

Posted on 2004-08-22
7
253 Views
Last Modified: 2010-04-13
Hi,

I have Win 2000 OS.
Recently I have started getting a irritating problem of my PC been rebooted on its own. The error message says "c:\winnt\system32\lsass.exe exited with error code 120".

The m/c boots in 60 secs..
Norton sayz no viruses found.

Watz rong in my PC.
Please gimme an exact answer as in wat shud be done.
Thanks in advance
Prasad

0
Comment
Question by:pai_prasad
7 Comments
 
LVL 49

Expert Comment

by:sunray_2003
ID: 11864409
Though Norton reports no virus ( assuming you got the latest virus definitions for it) , there might be sasser worm

Removal tool : http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displaylang=en

Removal Instructions:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html#removalinstructions

Manual removal :


  1. Disconnect your computer from the Internet.
  2. Boot in Safe Mode by pressing the F8 key during startup.
  3. Navigate to your Windows directory (c:\WINDOWS or c:\WINNT) on your
hard drive.
  4. Look for a file named AVSERVE.EXE. Delete it.
  5. Click on the Start menu and select Run.
  6. Type "regedit" (without quotes).
  7. Navigate to the following Registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  8. In the windows to the right, look for a value called avserve. Delete
it.
  9. Exit RegEdit.
  10. Reboot.

Once your system is up, go to windowsupdate.microsoft.com and update with the patches.
0
 
LVL 10

Author Comment

by:pai_prasad
ID: 11864472
Hi,

I ran the Sasser worm removal tool

http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displaylang=en

but it sayz "No infection found."


0
 
LVL 49

Accepted Solution

by:
sunray_2003 earned 250 total points
ID: 11864476
pai_prasad,

Go to http://windowsupdate.microsoft.com and check for updates.
Do all the updates
Restart the machine and check
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 86

Expert Comment

by:jkr
ID: 11864768
>>"c:\winnt\system32\lsass.exe exited with error code 120".

Error code 120 is

//
// MessageId: ERROR_CALL_NOT_IMPLEMENTED
//
// MessageText:
//
//  This function is not supported on this system.
//
#define ERROR_CALL_NOT_IMPLEMENTED       120L

Have you installed some SW that is NT or XP only recently?
0
 
LVL 15

Expert Comment

by:Rob Stone
ID: 11868387
Try this online virus scan - http://housecall.trendmicro.com/
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 11869380
0
 
LVL 2

Expert Comment

by:coopey247
ID: 11895132
The PC that is rebooting is not necessarily infected with a virus.  However it needs MS04-24 (I think), its the blaster patch.  Somewhere on your netowork a PC is scanning and attempting to infect these rebooting machines.  The machines that are rebooting may never actually get infected(which is why anti-virus says nothing is wrong), but until you close the back door with the MS patch, they will continue to reboot.

The virus blows up the LSASS service in an attempt to infect, which causes the reboot.
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
We have come a long way with backup and data protection — from backing up to floppies, external drives, CDs, Blu-ray, flash drives, SSD drives, and now to the cloud.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now