[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2017
  • Last Modified:

Lsass.exe  Application Error reboots computer. WinXP Fully Patched SP2

I have been searching all over for an answer to this issue. All the records on this issue are from 2004. Obviously the issue is similar, but not the same.

I am running a fairly new Windows XP SP 2 laptop, fully patched.
The user suddenly started getting this lsass.exe application error:

Lsass.exe  Application Error
The instruction at 0x757a1273 referenced memory at 0x0000001. The memory could not be written.
Once you click OK you get the following message before the system reboots:
The system process c:\windows\system32\lsass.exe terminated unexpectedly with status code -1703741819. The system will now shut down and restart

The event viewer states:
Faulting application lsass.exe version 5.1.2600.2180, faulting module lsasrv.dll, version 5.1.2600.2976, fault address 0x000712373.

I checked under the registry for the usual suspects such as sasser.

In hotkey_local _machine\software\microsoft\windows\run has the following unusual code:

Name: UserFaultCheck
Type: REG_EXPAND_SZ
Data: %systemroot%\system32\dumprep 0 -u

Another thing that happened was at boot up I got an LSA Shell (Export Version) uncounted a problem and needed to close.

Now I have run virus scanning and have found nothing. I also ran spyware problems. The system is patch patched beyond Sasser vulnerabilities. Im totally confused. I havent seen any Google entries past 2005 for this error.

HELP!!!
0
rlm338
Asked:
rlm338
  • 3
1 Solution
 
Vyper28Commented:
First step i would suggest is heading here: http://www.memtest.org/ and downloading the memtest iso, burn it to a cd and boot from it. Run the test, lets rule out actual faulty RAM before we start trying to hunt down the application causing the problem.

Some quick stuff you can check: Search the computer for lsass.exe you should have 3 results C:\windows\system32\
C:\WINDOWS\ServicePackFiles\i386
C:\WINDOWS\SoftwareDistribution\Download\bunch of stuff.

If you have anymore check the file names careful, though as you say, your machine should be sasser proof if it's fully updated.

Have you done an msconfig? Maybe try disabling everything and rebooting, see if the problem persists?
Does it crash constantly in normal mode? If you can get it running stable for a decent amount of time, try running an sfc scan. You need a windows disk, put it in the drive, start-->run--> sfc /scannow

I suspect if the machine truly is patched up, the ram could actually be the issue.
0
 
yasserdCommented:
0
 
rlm338Author Commented:
I can boot the system in safe mode without any failure. It happens after the initial login in normal mode. Connected or unconnected to the internet. I tried doing a system restore to the day before. The system booted fine but then five minutes later, got the same failure.

- I only had one lsass.exe in the system32 directory, no place else.
- The sytem is less than a month old and fully patched with SP2.
- It crashes at boot up every time. If I leave the error message up, the system seems to work fine. As   soon as I close out the error message, the system gives me the warning and reboots itself.
- Ran Memtest  - No errors
- Running sfc /scannow - No errors
0
 
rlm338Author Commented:
I ran SuperAntiSpyware and http://www.kaspersky.com/virusscanner. Neither one of them has shown anything. I will run the others but suspect I'll find the same thing.
0
 
rlm338Author Commented:
I think one of the scans did the trick. Not sure WHAT happened but it seems to be working now. I rebooted after the memory test, and it amazingly didn't crash! Thank you!!! For whatever the answer was. :-)

Of course I could have reformatted and redid the computer in less time than it took to get the error to go away. ugh...
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now