Solved

Windows XP Shuts Down every 10 minutes - lsass.exe error - fdisked and restaged twice

Posted on 2004-10-13
8
409 Views
Last Modified: 2008-03-17
We have a machine that was shutting down every ten minutes or less due to an lsass.exe error.  Stinger performed, windows updated, and mcafee updated - problem still persisted.  Completely fdisked the machine and restaged the machine.  The problem still persists.  Tried it another time and still no fix.  Does anyone have any suggestions on what the cause of this problem is and what can we do to fix it.  We're stumped.

T
0
Comment
Question by:AxesWannabee
  • 2
  • 2
  • 2
  • +1
8 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12302530
Hello AxesWannabee =)

Is the machine on network ??
try disconnecting the modem\dialup\networking card if its having one connected and then try ??
0
 

Author Comment

by:AxesWannabee
ID: 12302569
We've actually done that. Yes, it's connected to the network, but removing didn't change anything.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12302665
>> Yes, it's connected to the network,

so before fdisking and reinstalling,,,, did u disconnect all network\dialup\modem from it or....??
ad after installing, does the error starts coming at once or after connecting to internet ??
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 4

Accepted Solution

by:
Evarest earned 250 total points
ID: 12302711
If you're having trouble with lsass it's most probably due to the so called sasser worm. The latest variant i know of is quite a "pain in te ass", pardon my expression, but it just is.

The problem with stinger is that it doesn't always find all the virus instances. This particular virus will create several copies of itself, which will be run when windows starts.

You might want to update your windows, so the lsass error doesn't occur anymore:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

and further reading material:
http://vil.nai.com/vil/content/v_125007.htm

or you can manually remove the service that's executing the worm:
http://support.microsoft.com/?kbid=321024#kb3

Always nice to have such a thing on your computer, isn't it (i had it a couple of days ago after a format...)

Good luck!
Evarest

0
 
LVL 4

Expert Comment

by:Evarest
ID: 12302728
Oh yeah, the sasser worm will scan for "random" IP addresses and then upload itself to that computer. This is the reason why you'll be infected the moment you go online or on your network.

To prevent infection (or better: make it more difficult), update windows before going on your network.

Evarest
0
 

Author Comment

by:AxesWannabee
ID: 12302789
Thanks everyone for your help- we'll try that and let you know how it goes.
0
 
LVL 8

Expert Comment

by:Sam Cohen
ID: 12302909
is it counting down from 45?
if so , i t could be a virus
0
 
LVL 8

Expert Comment

by:Sam Cohen
ID: 12302914
systematic  norton AV website
has a fix for it
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question