Lsass.exe Kills Its Self

[nightfox1405241487 0]

On my other computer, I've been having some strange problem recently. After X minutes or so, lsass.exe gets terminated on its own and the computer reboots. I've formatted the drive and have re-installed Windows XP... 3 times now and the same thing keeps happening BUT I think it might be the NVIDIA graphics driver since I don't have the problem until I install the driver, which I highly doubt is doing this.I've run spyware scans and virus scans... nothing.My Windows XP disk is perfectly fine. I've used it on previous installs without problems. I'm almost tempted to install Windows 98 on it since it never crashed.Thanks for any ideas![N]F

[miCRoSCoPiC^eaRthLinG 0]

Dude I've faced this same problem with both Win2K and XP even with the service packs installed. It had something to do with the Sasser/Blaster worm - someone has an infected computer on your network which keeps broadcasting it and it keeps killing the LSASS.EXE on other systems. Even if you reinstall XP, it just keeps coming back in and messing around with your lsass. I'm not quite sure about the exact methodology. But I'd found this standalone patch - which totally blocked it.

 

I forgot the link to the site, but the name of the file was Windows2000-KB823980-x86-ENU.exe if I remember correctly. This was the Win2K version - but am sure they've got the same for XP too. Just google for it.

[nightfox1405241487 0]

Thanks m^e! I'm not sure where it may be coming from. I think of all the computers are currently off except for mine (both).Just to be cirtian, I'll check.Also, it has been holding strong. It's been on for about 30 minutes now without that message. Does the worm also disable Administrator account access? I've got a Sophos Anti-Virus on loan from my school but I have to get in Administrator but Windows wouldn't let me in. A message box popped up saying some internal error occured.Thanks![N]F

[Andrew1405241517 0]

I've had this problem and figured it was a hardware problem. I ended up just using a different PC.

[miCRoSCoPiC^eaRthLinG 0]

Thanks m^e! I'm not sure where it may be coming from. I think of all the computers are currently off except for mine (both).

It could very well come from another computer on your ISP's network - it doesn't have to be one on your own LAN. When it struck me - it always came from a different comp. on my ISP net.

Just to be cirtian, I'll check.
Also, it has been holding strong. It's been on for about 30 minutes now without that message.

Yep - the behaviour was always kind of inconsistent. Sometimes it stopped bothering me altogether for days and then it'd pop-back suddenly one fine morning and then bug me for the whole day. I don't know what exactly determines it's frequency of attack. But once I used that patch, it stopped for good.

Does the worm also disable Administrator account access? I've got a Sophos Anti-Virus on loan from my school but I have to get in Administrator but Windows wouldn't let me in. A message box popped up saying some internal error occured.
Thanks!

[N]F

Umm.. I don't think so. At least I never faced such a problem. Dude - one thing I suggest, you buy a copy of BitDefender. It's an excellent AV though still relatively unknown. I've been using it for over 2 years now - first time when I bought it, I paid $45 - which is hardly anything when you consider the amount of security it provides. Renewal every year is for $24 - which again in NOTHING. It's got an integrated firewall and an anti-spam module apart from the Antivirus. The most notable factor is how dedicated their team is - you'll find it updating it's virus database almost REGULARLY.. sometimes even 3-4 times a day. Any new threats in the market, and they'll have a patch out in no more than a day. Go grab a copy man.. it'll save you from immense headaches later on.. At least this AV is a thing that I never compromise on