lsass.exe shuts down computer automatically

[99mel]

Hi,

I have a Windows XP Home with sp2 and all the lastest updates installed. However when booting up to the log in screen it pops up with a box saying along the lines of lsass.exe has unexpectedly been terminated and then gives a 1min countdown to shut down.

I have read up to stop this automatic shutdown type shutdown -a in the command prompt but windows doesn't even get to the log in screen never mind the the desktop for me to enter this command.

Has anyone got any other suggestions to what I can do?

 

[aquias]

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

That is a link to the sasser virus removal tool. Download this and try to boot into safe mode, then run the removal tool and see if/what it will clean off your system.

It does sound like the sasser virus...but I thought MS had fixed the exploit to allow this.

 

[99mel]

It wouldn't even boot into safe mode, same thing happened, message popped up before i could even get to the desktop. I hooked the hard drive up to another machine and ran several anti virus programs with no virus results what so ever.

I gave up and have re-installed XP. Good old Microsoft for you.

 

[LloydSev]

that's not microsoft's fault...

that was indeed a sasser issue...

Quote from Symantec Site...

Note: The Lsass.exe process will crash after the worm exploits the Windows LSASS vulnerability. Windows will display the alert and shut down the system in one minute.

You can't blame MS for something caused by a malicious code writer. They patched the vulnerability.

Computer/Network Technician
CCNA

 

[2ffat]

Now that you've reinstall XP, make certain you are fully patched!

James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]

 

[99mel]

I would of thought that is Microsofts fault by having a vulnerability issue in the lsass.exe process?

What worries me about this is that there was SP2 installed, firewall activated and upto-date anti-virus software. May be this virus has been sitting around dormant or something, I dont know how it has happened.

 

[Kesser]

I was under the impression that sasser only auto shutdown the machine when you were connected to the net - I have never seen or heard of it shutting down the machine before it even boots into windows....

I agree the fault lies with Microsoft - they enjoy testing unfinished software on the general public who generally have no idea what to do when things go wrong... ahem sorry, i will stop that rant in it's tracks...

I'm not convinced it's sasser and feel i must look into it, will be back..

Kes

 

[LloydSev]

Every software has vulnerabilities.

MS fixed this.

Think about this..

If you own a car, which has an alarm on it..

Now, a car thief comes around and disables your alarm by cutting a few wires..

Who's fault is it that your car alarm did not go off?

The thief or the car alarm company?

I would have to blame that one on the thief.

Computer/Network Technician
CCNA

 

[kenred]

What if you own a car

and the company that makes the car knows that if you open the back door the alarm doesnt go off.

A thief enters the car via the backdoor and the alarm doesnt go off.

Whos fault is that, must be the car company.

Just a thought

 

[LloydSev]

Yours, since you know it doesn't work on the backdoor.

You should have bought extra protection to protect the back door.

You as the purchaser are always liable for what happens on your machine. If you get infected, it's your fault for not having enough security. Never depend on someone else for security. You have to be proactive.

Computer/Network Technician
CCNA

 

[2ffat]

Heres my two cents worth.

If the car company doesn't inform anyone of the backdoor problem, it's the company's fault.

If the company informs owners that a recall/update is available but the owner doesn't take advantage of the recall/update then it becomes the owner's fault.



James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]

 

[LloydSev]

I kinda assumed the "car company" had informed the owners.. otherwise that would be a large lawsuit, had they known about it and not made it public knowledge.

Computer/Network Technician
CCNA

 

[2ffat]

Wouldn't have been the first time ;-) .

James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]