lsass.exe system shutdown on xp

[AntiquePhil]

I'm having a system shutdown problem similar to the one caused by the blaster worm, but this one involves lsass.exe with error code 1073741819.

I have found some information on this problem as it relates to Win 2000, but nothing that deals with XP, which I'm running.

I get a system shutdown message with a 60 second timer and then a reboot.

Any help will be greatly appreciated.

[paul9]

http://uk.trendmicro-europe.com/ente...secall_pre.php
try a virus scan, that link is a free online scan. if you cannot stay online long enough because your 'puter tries to reboot, then click start >run type the word command into the little box which pops up. a larger black dosbox will popup. in that one, type "shutdown -a" without the quotes. that should cancel the shutdown. if it isn't a virus/worm/trojan causing your problem then let the forum know.

[AntiquePhil]

Thanks Paul. The "shutdown -a" command works like a charm. I ran my Norton Antivirus software (fully updated) and came up clean. I don't think it's a virus.

Windows has a fix for this problem for Win 2000 at:

http://support.microsoft.com/default...roduct=win2000

But this is only applicable to Win 2000, not XP. I run XP, and can't figure out how to adapt the fix.

[paul9]

maybe try shutting down the ldap service, if you don't use this. sp1 may also fix this for you if it doesn't kill your xp installation. to shut down services in xp right click my computer, manage, services.

[narsche]

most prob it's the W32.Sasser.Worm or W32.Gaobot at work.
you're using norton antivirus, download the virus updates via LiveUpdate, run a scan and you should do fine.

also, make sure you install the latest security update download from ms:
http://www.microsoft.com/technet/sec.../ms04-011.mspx

remember to disable system restore before installing the update.

hope all goes well.

[pongracz]

I just finished using the stinger available at the McAffee site http://vil.nai.com/vil/stinger, downloaded it and ran if on my XP machine. You should go to the thread dealing with NT Authority\Shutdown for more information. It did for me. I just finished scanning all my files and the stinger deleted five variants of the Sasser virus and corrected one file. It only found the virus effects on the C: drive, none of the other drives appeared to be infected and now works fine.

[SpookyEddy]

Do not leave netbios ports exposed to untrusted networks, simply enabling XP's built in firewall would prevent worms like Sasser and Blaster ever getting started. Also remember to run windows update, patches for the vulnerability exploited by the Sasser worm were available before it was ever reported in the wild.

Regards

ed

[ArcticFox]

http://www.techimo.com/forum/t31300.html

[omalleytrading]

AntiquePhil - not to jump all over you but....

Come on!

You must, must, must keep your computer up to date with the latest patches. Everyone reading TechIMO should know enough to run Windows Update on a regular basis. Heck, you can even set it to download and install the latest updates automatically!

There's just no excuse for not doing it.

Same goes for the AntiVirus updates. Every major AV program has an automatic update feature. Set it and forget it.

Those two simple things will prevent 95% of the problems that millions of people have every time one of these new viruses comes around.

[fotoguy]

thanks for the harsh words of wisdom, LOL.. I understand about the updates, this is my first serious virus and im gonna knock this sucker out and update very often, if not daily..

Adam