Unsolved
This post is more than 5 years old
6 Posts
0
13113
August 3rd, 2004 01:00
OptiPlex GX 270 - NT Authority Error Message C:WINNT/system32/Lsass.exe' terminated unexpectedly with status code 128
This is a Dell Optiplex GX 270 , Windows 2000 Professional OS Service Pack 4, IE 6.0 SP1
When attached to the internet/dsl connection it will operate for about 2-4 minutes then issue the error message in the subject and proceed to close down on a 1 minute timer.
It seems from my research to be a sasser worm infection however, I have run all the removal tools ( Microsoft, Stinger and Norton) and no sasser worm has been detected.
I have been unable to run all the current MS Operating Updates as it keeps shutting down when connected to the internet.
Any advice is welcome... Help Please!!!!!!!!
I am a 1st time user of this forum so please excuse any deficiencies in my posting.
jwatt
4.4K Posts
0
August 3rd, 2004 01:00
I just found the most comprehensive set of notes on Sasser variants I've ever seen. I didn't know that the creation of the file "dcpromo.log" is a potential way of stopping the shutdown. If you have the Win2K resource kit, you have a copy of shutdown.exe, which can be used to abort a shutdown, according to its "help", accessible with shutdown /?.
I'd also suggest obtaining a small router and connecting it between your Win2K system and your DSL connection. The "NAT" feature of all the home broadband routers will prevent traffic from worms like this from reaching your system.
Jim
NuBee
6 Posts
0
August 3rd, 2004 16:00
Thank you for your prompt response. We were finally able to download the the update from Microsoft and have been able to return the workstation to acceptable performance levels.
We are initiating an install of the Linksys 802 G Wireless router to start a wirefree network in the house. Will this serve the same purpose you describe in your last paragraph?
The notes to which you referred were extremely detailed and useful.
Thanks again for your assistance.
Ed (Nubee)
jwatt
4.4K Posts
0
August 3rd, 2004 16:00
You're welcome! Just curious...how did you stabilize the system so you could install the updates?
Yes, the Linksys wireless routers are an example of devices that do "Network Address Translation" for clients on the LAN side. Note that there are special security issues associated with wireless. Linksys has a short article highlighting most of them.
Jim
NuBee
6 Posts
0
August 3rd, 2004 18:00
Hi Jim,
We actually were able to download and install updates within the time we booted and the actual time the system booted down as the connection we had was very effective and the system has a 1.4 processor and 512 Ram.
My friend was very happy when he called. I am passing on all this information tonight for his records.
Thank you once again for you insight and valuable assistance.
My Best to You
Hydralisk00222
2 Intern
•
2.4K Posts
0
August 11th, 2004 23:00
When this happened to other computers I was fixing I just ignored the error window, just let it sit there ... (apparently it didn't shut down in a minute)
It gave me enough time to download the removal tool and the update KB835732. I was on 56K too
Message Edited by Hydralisk00222 on 08-11-2004 08:34 PM
jwatt
4.4K Posts
0
August 12th, 2004 05:00
Sometimes, inaction's your friend!
P.S. I trust you have a signature more in the spirit of your older ones under development...
Jim