lsass.exe fails and reboots

Hello all,

Simple problem this.. Looks like Sasser Worm has hit my Server 23k Enterprise (acctually all 3 of our server boxes we have). I get lsass.exe has caused an error and reboots after 60 seconds.. the problem is intermittent... its been fine for days and we thought it was just a bug but now its doing it every couple of hours.

When i boot up in the event log there is: A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005

Right ive used stinger and norton removal tools but nothing is picking up this. Says I am clean? Tried Macfee, Symantec Corprate AntiVirus and AVG to see if it picks it up and get nothing. Tried Adaware and Microsoft Malicious Software tool thinking it maybe some form of MalWare but nothing either. The server is fully up-to-date with its Windows patches and service packs. By googleing the error someone has had the problem as well but no one replied In sasser related posts they recommended changing the "restart when crashes" system in services by changing to restart service instead of restart computer but doesnt look like it worked. Someone also said when the error comes up do (i think) shutdown -a in DOS.. thinking this we put it in a bat script and launched it every 50 seconds. This failed also ive changed it to 10 seconds but ill have to wait and see if it works.

On event log here is the source and id:

Source: LSAsrv
ID: 5000

and two of the error messages:

Faulting application lsass.exe, version 5.2.3790.0, faulting module lsasrv.dll, version 5.2.3790.1023, fault address 0x0002a411.

A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

If you need any info please say These 3 servers have our customers on there and as you can imagine its starting to annoy everyone

Chris

 

Got o this page to remove malicious software:

here

Go to this page to find sasser worm:

here

Go to here to find how to remove:

here

And finally the security update you need:

here

 

I too had this issue on approx 12 of our clients servers.

All Server 2003, all rebooting, all had up to date virus software installed.

I ran any number of virus scans, using the installed software, online software, tools, ect, no virus found at all.

Applied SP1 for 2003 Server, then a windows update, and installed all pertinent fixes. So far no reboots. However, there still seems to be some issue with them all "hanging" intermittantly. Only way to get the servers back is to reboot !!! So the fix obviously hasnt worked as it should, must be some other issue !!

 

Same issue here

Having the same problem, here are my errors messages

Faulting application lsass.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x0001ee70.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.


This is realllly random stuff. can go 12 hours and sometimes will reboot every 20 minutes. I getting tired of everyone linking Sasser info.

I dont have Sasser, my server is clean, let me just say it one more time, I have dealth with Sasser and this isnt the problem.

Machine is clean

Win2k3 Server running SQL and IIS
All patches with exception to SP1, I cant load SP1 without a couple weeks product testing.

Anyone have any insight at all? other than links to virus info

 

same here, server boot at random moments... don't really know why, but it's NOT Sasser. Everybody keeps on saying, but it just isn't! Nobody seems to know what it is though...

 

I too have the same symptoms.
W2k3 server with all security patches and SP1, running Exchange 2003.
Seemed to start after installing SP1 but cant pinpoint it more than that

UPDATE
Now cannot remote control the server nor log on locally (can log on but no desktop)

This is the second server exhibiting these symptoms

Done virus scan and nothing found

 

Given how widespread this issue seems to be, it seems like opening a support case with Microsoft might be in order. They may already know about the issue and have a fix they simply haven't published but even if not, their techs are great for digging into the strange issues.