Solved

Windows XP Shuts Down every 10 minutes - lsass.exe error - fdisked and restaged twice

Posted on 2004-10-13
8
413 Views
Last Modified: 2008-03-17
We have a machine that was shutting down every ten minutes or less due to an lsass.exe error.  Stinger performed, windows updated, and mcafee updated - problem still persisted.  Completely fdisked the machine and restaged the machine.  The problem still persists.  Tried it another time and still no fix.  Does anyone have any suggestions on what the cause of this problem is and what can we do to fix it.  We're stumped.

T
0
Comment
Question by:AxesWannabee
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +1
8 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12302530
Hello AxesWannabee =)

Is the machine on network ??
try disconnecting the modem\dialup\networking card if its having one connected and then try ??
0
 

Author Comment

by:AxesWannabee
ID: 12302569
We've actually done that. Yes, it's connected to the network, but removing didn't change anything.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12302665
>> Yes, it's connected to the network,

so before fdisking and reinstalling,,,, did u disconnect all network\dialup\modem from it or....??
ad after installing, does the error starts coming at once or after connecting to internet ??
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 4

Accepted Solution

by:
Evarest earned 250 total points
ID: 12302711
If you're having trouble with lsass it's most probably due to the so called sasser worm. The latest variant i know of is quite a "pain in te ass", pardon my expression, but it just is.

The problem with stinger is that it doesn't always find all the virus instances. This particular virus will create several copies of itself, which will be run when windows starts.

You might want to update your windows, so the lsass error doesn't occur anymore:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

and further reading material:
http://vil.nai.com/vil/content/v_125007.htm

or you can manually remove the service that's executing the worm:
http://support.microsoft.com/?kbid=321024#kb3

Always nice to have such a thing on your computer, isn't it (i had it a couple of days ago after a format...)

Good luck!
Evarest

0
 
LVL 4

Expert Comment

by:Evarest
ID: 12302728
Oh yeah, the sasser worm will scan for "random" IP addresses and then upload itself to that computer. This is the reason why you'll be infected the moment you go online or on your network.

To prevent infection (or better: make it more difficult), update windows before going on your network.

Evarest
0
 

Author Comment

by:AxesWannabee
ID: 12302789
Thanks everyone for your help- we'll try that and let you know how it goes.
0
 
LVL 8

Expert Comment

by:Sam Cohen
ID: 12302909
is it counting down from 45?
if so , i t could be a virus
0
 
LVL 8

Expert Comment

by:Sam Cohen
ID: 12302914
systematic  norton AV website
has a fix for it
0

Featured Post

Enroll in May's Course of the Month

May’s Course of the Month is now available! Experts Exchange’s Premium Members and Team Accounts have access to a complimentary course each month as part of their membership—an extra way to increase training and boost professional development.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question