Help! Weird Error Message

thename1000 · #1 September 18th, 2005, 03:51 AM

I have win 2000, and when this error can up, I had was on the internet with a few programs opened...I've never seen this error before:

"The system is shutting down.....This shutdown initiated by NT AUTHORITY\SYSTEM" Then it gives a time before it shuts down, which starts at 60 sec.

Then it says under the heading "message"..."The system process C:\WINNT\system32\lsass.exe terminated unexpectedly with status code 128....The system will now shutdown and restart."

This happended twice in one day. Anybody know what system process that is, or why it stoped?? thanks

**Spider** · #2 September 18th, 2005, 09:13 PM

Hi thename1000 welcome to CyberTechHelp.

You have the Sasser/Blaster virus. You must have just reinstalled Windows 2000 and the version
on your CD is susceptible to those virii. You need Service Pack 4.

You need to download these...

Symantec Sasser fix tool
(doesn't matter if it says there is no Sasser, it does kill it)
Symantec Blaster fix tool
Windows 2000 SP4 full update 129Mb

Shut down
Disconnect the ethernet cable (Internet cable) from the computer
Boot to Safe Mode (press F8 key at one second intervals while computer is starting)
Run Sasser and Blaster tools
Reboot to Safe Mode again
Install the SP4 update
Reboot to Safe Mode again
Run the tools again
Reboot normal and go directly to Windows Update and install all critical updates showing
Keep rebooting after update installs and return to Windows Update until no crticals show

thename1000 · #3 September 20th, 2005, 01:12 AM

hmm...ok I will download those programs...But I already have SP4 on this computer, and has been for some time. Is that an update for the service pack, or just the whole service pack?

**Spider** · #4 September 20th, 2005, 04:24 AM

Could you download this file to your Desktop and two-click it, it will bring up a Notepad.
Could you copy and paste the contents of that here please.

thename1000 · #5 September 21st, 2005, 12:53 AM

Log started at 9/20/2005 6:54:07 PM
DELL-02C7940B9C - Service Pack 4.0

Told ya! lol

**Spider** · #6 September 21st, 2005, 02:23 AM

Something doesn't jive here, your SP4 may be broken or some system (Windows) files were over written.

Have you got some history on your computer activity in the last little while? Like had you installed something,
downloaded something, used file sharing, uninstalled something, deleted something....stuff like that.

Quote:

Originally Posted by thename1000

This happended twice in one day

I assume, from that, you can get this machine on the Internet and surf.
Go here to Panda ActiveScan and after everything is loaded select Local Disks to scan.
If it finds anything post the log file please.

thename1000 · #7 September 21st, 2005, 04:17 AM

ok thanks i will do that...but actually on that day it was the very first time this computer has been on the internet in about 4 or 5 months..could that be something?

thename1000 · #8 September 21st, 2005, 04:41 AM

oh hey...how could i forget this?: Some files must be corrupt of something because on this computer, the task manager, and regedit both do not come up. They flash on the screen, then close themselfs. This also used to happen to the command prompt, but it suddenly started working...

sorry bout the spacing...dont know how it happended

**Spider** · #9 September 21st, 2005, 05:21 AM

Have you anything on that computer that you deem important?

I want to wipe it clean and start with a fresh Windows. This would involve
using the Dell Windows CD and a clean install of Windows which would wipe
out everything you have and it can't be recovered.

Is this ok with you?

thename1000 · #10 September 21st, 2005, 05:33 AM

yeah thats pretty much the same thing my brother said; He has a XP disc that i can use...that would take care of the problem anyway

**Spider** · #11 September 21st, 2005, 05:28 PM

If you need any further assistance from us just let us know.

Good luck with that.

thename1000 · #12 September 22nd, 2005, 01:00 AM

ok thanx 4 all your help...um..could u please try 2 answer my monitor question now?(previous post) thanks....

**Spider** · #13 September 22nd, 2005, 04:19 AM

Your welcome.

Quote:

Originally Posted by thename1000

could u please try 2 answer my monitor question now

Done. Your monitor thread

When you refer to "links elsewhere" try to provide a link to it so members can
click to go there instead of searching for what your referring to.

Just highlight and copy from the address bar in IE and paste in the post.
Or you can use [ url=www.thelinkyoupaste]Click here[ /url]
I put spaces in [ url] and [ /url] so they would show but they are used without spaces ... [url=www.thelinkyoupaste]

thename1000 · #14 October 1st, 2005, 03:36 AM

Hey ok do have the W32.Sasser.E.Worm (Lsasss.exe) virus. This was not only shutting down my computer at random times, but I just found it was what was behind my recent and sudden slow internet connection. I found this out directly by using the program process explorer to look at the properties of the lsass.exe and more specifically the TCP/IP tab, and found when connected to the internet, that it was using the internet in some way. (don't know if this is normal, but right after i turned it off, the internet was running normally)

I will do the sasser fix tool (mentioned above) tommorow, and hopefully it will be gone.

For anyone wanting to know about the virus: http://vil.nai.com/vil/content/v_125007.htm