lsass.exe Shutdown

[djrock]

Hi, Every so often i get the shutdown box saying i have 60 seconds to save my work. It says something about lsass.exe code 128. I have zonealarm installed and AVG anti virus software installed. I have scanned my system with house call and spybot they have brought up nothing. I just 1 month ago reinstalled xp because i had this problem before. I don't know if theres an update i have install that is causing this.

Sys Spec

AMD K6 2 500MHz
PC CHIPS MOTHERBOARD
384MB RAM
WINXP SP1A

Thankyou

djrock

 

[etaf]

sounds like the sassar virus - but surprised not picked up by virus scan


got here and see what MS finds
http://www.microsoft.com/security/incident/sasser.mspx

theres a check for sasser there

To stop the PC from shutting down
Click Start, click Run and then in the Open field type: shutdown -a

This prevents the system from automatically restarting long enough for you to download and install the Microsoft security update.

 

[MFDnNC]

http://vil.nai.com/vil/stinger/

See what this finds:

Read this article in detail especially removal.

 

[djrock]

I don't think its the virus but i will try it since its sometimes at system startup it happens can't remember if it happens through the day after it has been started up. What is strange is when i start the system up is completely fine when my brother or dad starts the system it happens but not all of the time.

 

[etaf]

interesting article
That the problem reoccurs even when virus defs upto date - if windows not patched
http://www.gotapex.com/forums/archive/index.php/t-74503

 

[etaf]

and here
http://www.computing.net/windows2000/wwwboard/forum/59008.html

 

[MFDnNC]

Forgot to paste my other link

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

 

[djrock]

I have ran the stinger before it found nothing.

 

[etaf]

what about the update from MS

 

[djrock]

I have read ms help on it followed the instruction patched the system then ran there tool to find if the system has sasser it found nothing.

 

[etaf]

so was the system already patched or did it need patching

 

[djrock]

I don't know i don't think so but its patch now.

 

[etaf]

Ok - So is it possible to try and reproduce the problem - see if its fixed with the patch

 

[djrock]

I don't think so. Its strange but it does not always happen. When i start the system up no problem but if my brother or dad starts the system it happens it really annoying because i always get a complaint about it.

 

[etaf]

do you know if its anything they do thats repeatable? - otherwise you'll have to let them have a play