Xp station shutting down lsass.exe

[cjpmcglinchey]

Hi

I have many xp worstation closing down with the NT Authority system lsass.ese mentioned.

I have run several virus scanners and nothing is detected.

Any suggestions.

Thanks

 

[gpalmer711]

Are you sure it is not Sasser/Blaster? Follow the instructions in

http://www.palmersoft.co.uk/support/rpc.htm

there are links there that will take you to specific Microsoft pages that will check your PC for infection of the above, also good virus/Worm advice.

If you are sure that it is not that then let us know what the code is that you receive on the error message, this code should help diagnose the problem.

Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk

 

[bcastner]

LSASS.EXE is almost surely Sasser:

Diagnose, repair, and apply security hotfixes:

http://www.microsoft.com/security/incident/sasser.asp

Do the same steps for Blaster:

http://www.microsoft.com/security/incident/blast.asp

You can stop the shutdown by immediately doing this on seeing the warning:

Start, Run, shutdown -a

Be certain the latest Security Hotfixes are installed from Windows Udate, and be certain you have firewall protection for all your clients.

Diogenes10 recommended this freeware scanner, A2:

http://www.emsisoft.com/en/software/download/

The Blaster link above contains several alternative scanners, or see:

http://www.mvps.org/sramesh2k/Scanners.htm

If it proves not to be blaster or sasser these online scans run from a test workstation should show what it is. Do more than one: I like Trend Micro and Panda.