LSASS.exe shutdown after upgraidng to XP Professional

Help! Installed Cable modem, could not access, got corrupt file error message
(using WIn 98).
Loaded Upgrade to XP Pro. Was able to connect to Internet, but now system
shuts down every 60 secomds. Error Message is
Error LSA SHell Export Program -Win XP System Shutdown Logoff
nt authority\system
C:windows\sys 32\lsass.exe terminate
Status code 2147483645

Can anyone advise me on how to proceed? Thanks, CQ

Apparently, you accessed the internet before enabling Windows XP's
firewall and consequently infected your PC with the rampant Sasser worm.

Microsoft Windows Malicious Software Removal Tool (KB890830)
http://www.microsoft.com/downloads/d...displaylang=en

This tool checks your computer for infection by specific, prevalent malicious software
(including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found.

How to turn on or turn off the Internet firewall in Windows XP
http://support.microsoft.com/default...b;en-us;283673

Get Windows XP Service Pack 2 with advanced security technologies
http://www.microsoft.com/athome/secu...xp/choose.mspx

3 Simple Steps to Help Ensure the Protection of Your PC
http://www.microsoft.com/athome/secu...t/default.mspx

Antivirus software: Frequently asked questions
http://www.microsoft.com/athome/secu...antivirus.mspx

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/secu...t/default.mspx

------------------------------------------------------------------------------

"CQ" wrote:

| Help! Installed Cable modem, could not access, got corrupt file error message
| (using WIn 98).
| Loaded Upgrade to XP Pro. Was able to connect to Internet, but now system
| shuts down every 60 secomds. Error Message is
| Error LSA SHell Export Program -Win XP System Shutdown Logoff
| nt authority\system
| C:windows\sys 32\lsass.exe terminate
| Status code 2147483645
|
| Can anyone advise me on how to proceed? Thanks, CQ

Thank you, Carey: Unfortunately, the machine is shutting down to quickly (a
minute or two tops) to be able to access and download the removal tool. Any
suggestions?

"Carey Frisch [MVP]" wrote:

> Apparently, you accessed the internet before enabling Windows XP's
> firewall and consequently infected your PC with the rampant Sasser worm.
>
> Microsoft Windows Malicious Software Removal Tool (KB890830)
> http://www.microsoft.com/downloads/d...displaylang=en
>
> This tool checks your computer for infection by specific, prevalent malicious software
> (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found.
>
> How to turn on or turn off the Internet firewall in Windows XP
> http://support.microsoft.com/default...b;en-us;283673
>
> Get Windows XP Service Pack 2 with advanced security technologies
> http://www.microsoft.com/athome/secu...xp/choose.mspx
>
> 3 Simple Steps to Help Ensure the Protection of Your PC
> http://www.microsoft.com/athome/secu...t/default.mspx
>
> Antivirus software: Frequently asked questions
> http://www.microsoft.com/athome/secu...antivirus.mspx
>
> --
> Carey Frisch
> Microsoft MVP
> Windows XP - Shell/User
> Microsoft Newsgroups
>
> Be Smart! Protect Your PC!
> http://www.microsoft.com/athome/secu...t/default.mspx
>
> ------------------------------------------------------------------------------
>
> "CQ" wrote:
>
> | Help! Installed Cable modem, could not access, got corrupt file error message
> | (using WIn 98).
> | Loaded Upgrade to XP Pro. Was able to connect to Internet, but now system
> | shuts down every 60 secomds. Error Message is
> | Error LSA SHell Export Program -Win XP System Shutdown Logoff
> | nt authority\system
> | C:windows\sys 32\lsass.exe terminate
> | Status code 2147483645
> |
> | Can anyone advise me on how to proceed? Thanks, CQ
>
>

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Follow these directions to remove The Sasser Worm from your computer:
http://www3.telus.net/dandemar/sasser.htm

[Courtesy of MS-MVP Jupiter Jones]

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/secu...t/default.mspx

------------------------------------------------------------------------------

"CQ" wrote:

| Thank you, Carey: Unfortunately, the machine is shutting down to quickly (a
| minute or two tops) to be able to access and download the removal tool. Any
| suggestions?

Carey: Thank you so much for all of your help!

"Carey Frisch [MVP]" wrote:

> If your computer is constantly attempting to shutdown
> or reboot, quickly go to:
>
> Start > Run and type: CMD , and hit enter.
> This opens the Command Prompt window.
>
> Then type: shutdown -a , and hit enter.
>
> This should halt the rebooting problem.
>
> Follow these directions to remove The Sasser Worm from your computer:
> http://www3.telus.net/dandemar/sasser.htm
>
> [Courtesy of MS-MVP Jupiter Jones]
>
> --
> Carey Frisch
> Microsoft MVP
> Windows XP - Shell/User
> Microsoft Newsgroups
>
> Be Smart! Protect Your PC!
> http://www.microsoft.com/athome/secu...t/default.mspx
>
> ------------------------------------------------------------------------------
>
> "CQ" wrote:
>
> | Thank you, Carey: Unfortunately, the machine is shutting down to quickly (a
> | minute or two tops) to be able to access and download the removal tool. Any
> | suggestions?
>
>

You're welcome! Please remember to install SP2 at
your earliest convenience. Afterward, visit the Windows
Update web site for some additional critical updates and
then defrag your hard drive.

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/secu...t/default.mspx

------------------------------------------------------------------------------

"CQ" wrote:

| Carey: Thank you so much for all of your help!

OK, I have several windows XP machines. I've installed SP2, and then
did the critical updates from the ms update page. But when I og in as
administrator I'm still getting the LSA Shell export version error
message.

The MS Malicious Software removal tool tells me that my machine is
clean as do my anti-viral softwares (Computer Associates E-Trust, and
Stinger)

Any more suggestions?

Kevin

On Fri, 25 Feb 2005 17:17:43 -0600, "Carey Frisch [MVP]"
<> wrote:

>If your computer is constantly attempting to shutdown
>or reboot, quickly go to:
>
>Start > Run and type: CMD , and hit enter.
>This opens the Command Prompt window.
>
>Then type: shutdown -a , and hit enter.
>
>This should halt the rebooting problem.
>
>Follow these directions to remove The Sasser Worm from your computer:
>http://www3.telus.net/dandemar/sasser.htm
>
>[Courtesy of MS-MVP Jupiter Jones]

It is possible that the registry ACL for the key LSA may not be set to the
default.

The default ACL for the key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa
is:

Administrators Read & Full Control
Authenticated Users Read
CREATOR OWNER (*SPECIAL*) Full Control to Subkeys only
Server Operators Read
SYSTEM Read & Full Control

Before attempting the above, I'd suggest exporting the registry key by right
clicking the key and selecting export in case you need to bring it back into
the registry.

NOTE: you access the registry by going to Start and typing
regedit in the run box.

You should also make sure your data is backed up as well.

Also see:

"LSASS.EXE Terminated Unexpectedly with Status Code -1073741571" Error Message
http://support.microsoft.com/?kbid=321024

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/secu...xp/choose.mspx

-------------------------------------------------------------------------------------------

"kcw" wrote:

| OK, I have several windows XP machines. I've installed SP2, and then
| did the critical updates from the ms update page. But when I og in as
| administrator I'm still getting the LSA Shell export version error
| message.
|
| The MS Malicious Software removal tool tells me that my machine is
| clean as do my anti-viral softwares (Computer Associates E-Trust, and
| Stinger)
|
| Any more suggestions?
|
| Kevin