computer keeps shutting down and restarting 1

[qwert123]

One of our sales guys' PC keeps restarting, this is the message that appears before it restarts -
c:\winnt\system32\lsass.exe was terminated unexpectedly with code 128.
He has run a virus scan on the computer this found nothing. He also downloaded the Sasser virus removal tool and ran this and this found nothing.
Does anyone else have any ideas what could be causing this, we'd appreciate your help.

Thanks
AM

 

[satrow]

Sounds like viral/worm activity to me; try Start - Run - 'shutdown /a' and hit enter when the shutdown message comes up; then get to an online scanner - Panda or Trend, preferably both.

Andy.

 

[qwert123]

It does sound like a virus. He is in the process of trying this out, thanks for your help. I'll let you know what happens.

AM

 

[satrow]

Sorry! It's shutdown -a

Andy. (oops)

 

[chrissylaf]

Had the same problem...try installing the vulnerability patch as indicated at the MS site. It fixed our problem.

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

 

Does it let you go into safe mode? If so, maybe the Last known good configuration. It's gotten me out of a lsass before-?:| Symantec is another useful tool, unlike Panda and Trend, you don't need to download anything to use it and the cure lies right there. Good luck.

 

[Parcival21]

Isn't lsass a normal windows process while lsasss is the widely spread worm/virus. Maybe you're having problems with your windows installation. Had similar problems on several computers but not regularly. When I had I ran mcafee stinger and symantec removal tool. Nothing found. The problem never retourned on these computers. Someone told me lately that lsass.exe was a normal windows process that from time to time causes mistakes and shuts your computer down...
Maybe upgrading your system with service packs etc might help...
bye,
busche

 

[zaznet]

LSASS.EXE (Local Security Authority Subsystem Service) is a normal process to be running. The exit code does not sound like a "shutdown" process, but that of a critical error in Windows. I would update Windows with any patches available from Microsoft and the hardware vendor. Also check, remove, re-install any hardware that has been added to the system in the last 30 days (even USB pen drives).

If the problem is related to the Sasser worm, it is likely to be a result of another infected machine on the network tryign to perform the exploit. These exploits work by flooding a system that is vulnerable and by doing so allowing a program to be executed. When successful a program will often crash in an uncontrolled way. Programs crashing are NOT the most stable place to run other (virus) code. This is the main reason many of these worms fail to infect every machine on a given network.

I would scan the other computers on the LAN, I bet you have one infected that is trying to infect the crashing machine.

Nathan aka: zaz (zaznet)
zaz@zaz.net

http://www.zaz.net/

 

[qwert123]

Our Sales Rep applied the security patch that chrissylaf suggested and he hasn't had any problems since.

Thanks for all your help guys.

AM

 

[bcastner]

Put a firewall on that box.

http://www.free-firewall.org/

 

[zaznet]

qwert123,

I still think you want your administrators to look for other machines on the network that are infected with the virus. Some other machine was causing the workstation to reboot by trying to exploit the vulnerability. While the machine is no longer vulnerable, the infection is still there on your network.

Unless of course you have full direct access to the Internet and no corporate firewall to shield your LAN, then it could have been any machine on the Internet causing the infection attempts and reboots.

If you do not have an external firewall, then software like the suggestion from bill would be advised.

Nathan aka: zaz (zaznet)
zaz@zaz.net

http://www.zaz.net/