lsass.exe shutdowns the computer (W2K)

[rott3n]

Hello there,

My Win2k sp4 is doing that damn countdown, and is blaming lsass.exe for it. I have already scanned for viruses (which I've found and removed), and its still doing the shutdown thing. Can someone help me?

Thanks for reading :)

[SForshaw]

If you want to stop the system from shutting down, go to Start, Run and type in CMD - hit enter. In the Command line box, type "SHUTDOWN - A" without the Quotes. This will abort the system shutdown. Now you have time to scan your system to find the root cause. You might want to try downloading STINGER from McAfee - it is a stand-alone Virus scanner and it picks up most of the more prevelant Virii out there.

[Croupi3r]

Hi,

Is it possible you haven't got the latest Windows updates? If I'm not mistaken the Sasser worm is causing this shutdown, and even if you remove the worm, your comp will catch the worm soon again unless you download windows updates.

I hope that helps (or if it doesn't, I hope you find a solution)!

[rott3n]

Hi!
Tnxs for the answers

I had already tried the shutdown thing, but it seems that this command only works on Xp, doesnt it? I'm not sure, but it says the command doesnt exist.

But ill try the Stinger thing... thanks!
(if someone have some idea, i would be glad to hear it :)

[nonsence]

go and open the services mmc. scroll down to the Remote Procedure Call (RPC) service, open the properties, go the the Recovery tab, and change the recovery options from shutting down the computer or restarting the computer to either nothing or restarting the service. this should buy you time to fix your virus problem. it's probably a virus problem, blaster and sasser i think do much the same thing (ie restart the computer)

In the end, there can be only one....

[DrCasey]

Services mmc? I'm on an XP and I can't find that... well, the other computer that's an XP is screwing up...

[nonsence]

start menu, control panel, Administrative Tools, Services

scroll down to the Remote Procedure Call (RPC) service. double click on it. click on the recovery tab at the top of the new window. change the options in the drop down menus to whatever you want.

In the end, there can be only one....

[DrCasey]

Hey, kickass. For some reason, it was set to "Restart" for the first, second, and third failures. Thanks.

[beginner]

Hey i could be that late for that ... it's been time that i haven't been here ... it's just to tell you that the solution for your problem has been given by " Croupi3r" ...

[seongheng]

ok, i am not sure what coz this problem, but i face the same problem as well after patching the solution as below
http://www.jsiinc.com/subm/tip6000/rh6043.htm
but u need to do some modification for some of the command
eg:
copy c:\winnt\$NtUninstallQ299687$\advapi32.dll
it should be
copy c:\winnt\$NtUninstallQ299687$\advapi32.dll c:\winnt\system32

$NtUninstallQ299687$ might not be the same for ur case, u just locate any folder that contain all the required file.

best regards,
law

[seongheng]

get this from microsoft andd execute it, if u still able to login
Windows2000-KB835732-x86-ENU.EXE