lsass.exe terminates causing auto shutdown 1

[Poppy64]

Hi there.

Our XP Pro systems are set NOT to restart whenever there is a system failure(via Control Panel - System - Adavanced - Start Up & Recovery options) however we have one recurring problem.

Headed "System Shutdown", we get a message saying:

Shutdown was initiated by NT AUTHORITY\SYSTEM.
The system process C:\Windows\System32\lsass.exe terminated unexpectedly with status code 2147483641. The system will now shutdown and restart.

We have to set the date & time back to prevent the system restarting - imperative when programmers are coding!

If anyone can help me out here on how to stop this, I'd really appreciate it.

Poppy64

 

[Davetoo]

Been hiding under a rock? ;-)

http://www.tek-tips.com/viewthread.cfm?SQID=832911&SPID=779&page=1

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Poppy64]

Argh - sunshine...it hurts after being under this rock for so long ;-)

However, we are protected against sasser and just to make sure, I've run the Microsoft test and that confirms the pc is clear.

Since then, I have been handed an apparant fix for my problem, the information is as follows here:

KB835732-x86-ENU.EXE

Enter that in Google and it'll take you straight there. It's being tested now......

Poppy64

 

[Davetoo]

Um..yeah, I know, that's why I pointed you to that thread, as it contains the link to that fix.

Basically if the lsass fails, either you have sasser, or you're a victim of the fix for sasser, and have to apply a fix to the fix to fix it.

Got it? lol

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Poppy64]

D'oh. Sorry. To be honest, once I read the initial bits of your first reply I went straight to my boss cos I realised the potential seriousness of it. Didn't realise the fix was included - but forgive me - there is REAMS of stuff! (And it is Friday afternoon).

Anyway - thanks for your prompt and informative responses.

Have a great weeekend.

Poppy64

 

[Davetoo]

Bruce deserves the applause, he's been staying on top of this one for us all and keeping us well informed.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Davetoo]

Bruce? Who the heck is Bruce? lol

Bill Bill Bill

That's what he gets for laughing at me on the updates!

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[bcastner]

lander215,

Correction noted.

But you should be warned I missed according to linney "Bash linney week" and and like a shark, the blood is in the water here.

Best,
Bill Castner

 

[Poppy64]

I gave Bill a thank you star - and myself a pat on the back for working SOMETHING out this afternoon...I figured you meant Bill!

Thanks again.

Poppy64

 

[bcastner]

Poppy64,

That was very kind. I got very worried about Sasser last Tuesday or so, and as MS 04-011, the patch, was causing serious problem with some Win2k machines I tried to keep both the XP Forum and the Win2k forum as updated as possible on the issue.

By Thursday Morning it was clear this was messy (Blaster was in my opinion work as a practical matter), and by Friday morning it was clearly a huge mess.

I think I will *bump* the Sasser advisory for the site one more time, as it includes how to remove, and how to prevent/stop the problem.

Sorry for you problem. I wish the site allowed the occasionaly "sticky" note at the top of the Forum.

Best to all (except lander215),
Bill Castner

 

[Davetoo]

If you'll excuse me, I have to go redo my Christmas card list yet again.

;-)

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[bcastner]

lander215,

Save your XMAS list, although a nice thought, I doubt it would salvage your standing at the moment...

Many regular participants in the Forum create multiple email addresses, and multiple identies. "Bruce" is actually a code name for site administrators at one site (not Tek-Tips) when they want to send a private message to me. (I constantly referred to a BIG Forum member as Bruce, and not Brian).

So, I guess you are forgiven.

With reluctance,
Bill Castner