lsass.exe fails and reboots

From: ChrisOlver (ChrisOlver_at_discussions.microsoft.com)
Date: 06/05/05 

Date: Sun, 5 Jun 2005 08:26:02 -0700

Hello all,

Simple problem this.. Looks like Sasser Worm has hit my Server 23k
Enterprise (acctually all 3 of our server boxes we have). I get lsass.exe has
caused an error and reboots after 60 seconds.. the problem is intermittent...
its been fine for days and we thought it was just a bug but now its doing it
every couple of hours.

When i boot up in the event log there is: A critical system process,
C:\WINDOWS\system32\lsass.exe, failed with status code c0000005

Right ive used stinger and norton removal tools but nothing is picking up
this. Says I am clean? Tried Macfee, Symantec Corprate AntiVirus and AVG to
see if it picks it up and get nothing. Tried Adaware and Microsoft Malicious
Software tool thinking it maybe some form of MalWare but nothing either. The
server is fully up-to-date with its Windows patches and service packs. By
googleing the error someone has had the problem as well but no one replied In
sasser related posts they recommended changing the "restart when crashes"
system in services by changing to restart service instead of restart computer
but doesnt look like it worked. Someone also said when the error comes up do
(i think) shutdown -a in DOS.. thinking this we put it in a bat script and
launched it every 50 seconds. This failed also ive changed it to 10 seconds
but ill have to wait and see if it works.

On event log here is the source and id:

Source: LSAsrv
ID: 5000

and two of the error messages:

Faulting application lsass.exe, version 5.2.3790.0, faulting module
lsasrv.dll, version 5.2.3790.1023, fault address 0x0002a411.

A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
code c0000005. The machine must now be restarted.

If you need any info please say These 3 servers have our customers on there
and as you can imagine its starting to annoy everyone

Chris

Relevant Pages

  • Re: lsass.exe fails and reboots
    ... that meaning either SP1 is installed, or all security patches. ... > Enterprise (acctually all 3 of our server boxes we have). ... > When i boot up in the event log there is: A critical system process, ... > sasser related posts they recommended changing the "restart when crashes" ...
    (microsoft.public.security)
  • RE: ISA 2004 REPORT FAILURE
    ... Update on Restart procedure. ... only way to start firewall was to reapply ISA 2004 SP2 ... this stopped ISA server related services ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • RE: After upgrading 2000 server to 2003 server keeps restarting
    ... troubleshooting blue screen stop/automatically restart issues are ... applications are fully compatible with Windows Server 2003. ... and then try the upgrade to see if it works. ... It is better to contact Microsoft Product Support Services via telephone ...
    (microsoft.public.windows.server.migration)
  • RE: Active Directory Repair indices
    ... I know that when you restart your Windows 2003 SBS ... Click Services tab and select Hide All Microsoft Services and Disable ... In Directory Services Restore Mode, run the semantic checker on the ... Apply Predefined Security Templates in Windows Server 2003 ...
    (microsoft.public.windows.server.sbs)
  • Re: Help - Sever Status Reports Failing
    ... But a server restart trumps that, so don't bother to do it now. ... I restarted the server with no help, and also restarted the Server Reports ... This error use to be listed in the morning status report, ... preferredCulture, Int32 approvedStates, DateTime fromSyncDate, ...
    (microsoft.public.windows.server.sbs)
Quantcast