Solved

Windows XP Shuts Down every 10 minutes - lsass.exe error - fdisked and restaged twice

Posted on 2004-10-13
8
414 Views
Last Modified: 2008-03-17
We have a machine that was shutting down every ten minutes or less due to an lsass.exe error.  Stinger performed, windows updated, and mcafee updated - problem still persisted.  Completely fdisked the machine and restaged the machine.  The problem still persists.  Tried it another time and still no fix.  Does anyone have any suggestions on what the cause of this problem is and what can we do to fix it.  We're stumped.

T
0
Comment
Question by:AxesWannabee
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +1
8 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12302530
Hello AxesWannabee =)

Is the machine on network ??
try disconnecting the modem\dialup\networking card if its having one connected and then try ??
0
 

Author Comment

by:AxesWannabee
ID: 12302569
We've actually done that. Yes, it's connected to the network, but removing didn't change anything.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12302665
>> Yes, it's connected to the network,

so before fdisking and reinstalling,,,, did u disconnect all network\dialup\modem from it or....??
ad after installing, does the error starts coming at once or after connecting to internet ??
0
What Is Transaction Monitoring and who needs it?

Synthetic Transaction Monitoring that you need for the day to day, which ensures your business website keeps running optimally, and that there is no downtime to impact your customer experience.

 
LVL 4

Accepted Solution

by:
Evarest earned 250 total points
ID: 12302711
If you're having trouble with lsass it's most probably due to the so called sasser worm. The latest variant i know of is quite a "pain in te ass", pardon my expression, but it just is.

The problem with stinger is that it doesn't always find all the virus instances. This particular virus will create several copies of itself, which will be run when windows starts.

You might want to update your windows, so the lsass error doesn't occur anymore:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

and further reading material:
http://vil.nai.com/vil/content/v_125007.htm

or you can manually remove the service that's executing the worm:
http://support.microsoft.com/?kbid=321024#kb3

Always nice to have such a thing on your computer, isn't it (i had it a couple of days ago after a format...)

Good luck!
Evarest

0
 
LVL 4

Expert Comment

by:Evarest
ID: 12302728
Oh yeah, the sasser worm will scan for "random" IP addresses and then upload itself to that computer. This is the reason why you'll be infected the moment you go online or on your network.

To prevent infection (or better: make it more difficult), update windows before going on your network.

Evarest
0
 

Author Comment

by:AxesWannabee
ID: 12302789
Thanks everyone for your help- we'll try that and let you know how it goes.
0
 
LVL 8

Expert Comment

by:Sam Cohen
ID: 12302909
is it counting down from 45?
if so , i t could be a virus
0
 
LVL 8

Expert Comment

by:Sam Cohen
ID: 12302914
systematic  norton AV website
has a fix for it
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question