Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 419
  • Last Modified:

Windows XP Shuts Down every 10 minutes - lsass.exe error - fdisked and restaged twice

We have a machine that was shutting down every ten minutes or less due to an lsass.exe error.  Stinger performed, windows updated, and mcafee updated - problem still persisted.  Completely fdisked the machine and restaged the machine.  The problem still persists.  Tried it another time and still no fix.  Does anyone have any suggestions on what the cause of this problem is and what can we do to fix it.  We're stumped.

T
0
AxesWannabee
Asked:
AxesWannabee
  • 2
  • 2
  • 2
  • +1
1 Solution
 
SheharyaarSaahilCommented:
Hello AxesWannabee =)

Is the machine on network ??
try disconnecting the modem\dialup\networking card if its having one connected and then try ??
0
 
AxesWannabeeAuthor Commented:
We've actually done that. Yes, it's connected to the network, but removing didn't change anything.
0
 
SheharyaarSaahilCommented:
>> Yes, it's connected to the network,

so before fdisking and reinstalling,,,, did u disconnect all network\dialup\modem from it or....??
ad after installing, does the error starts coming at once or after connecting to internet ??
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
EvarestCommented:
If you're having trouble with lsass it's most probably due to the so called sasser worm. The latest variant i know of is quite a "pain in te ass", pardon my expression, but it just is.

The problem with stinger is that it doesn't always find all the virus instances. This particular virus will create several copies of itself, which will be run when windows starts.

You might want to update your windows, so the lsass error doesn't occur anymore:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

and further reading material:
http://vil.nai.com/vil/content/v_125007.htm

or you can manually remove the service that's executing the worm:
http://support.microsoft.com/?kbid=321024#kb3

Always nice to have such a thing on your computer, isn't it (i had it a couple of days ago after a format...)

Good luck!
Evarest

0
 
EvarestCommented:
Oh yeah, the sasser worm will scan for "random" IP addresses and then upload itself to that computer. This is the reason why you'll be infected the moment you go online or on your network.

To prevent infection (or better: make it more difficult), update windows before going on your network.

Evarest
0
 
AxesWannabeeAuthor Commented:
Thanks everyone for your help- we'll try that and let you know how it goes.
0
 
Sam CohenConsultant to Digital/DeveloperCommented:
is it counting down from 45?
if so , i t could be a virus
0
 
Sam CohenConsultant to Digital/DeveloperCommented:
systematic  norton AV website
has a fix for it
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 2
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now