server 2003 reboot with error at lsass.exe

Alessandro · 22-09-2006

I have a windows 2003 server that randomly reboot, about every 15 days. In
the event I found always the same errors
(I add a english translation description between [] )
Hardware is a Dell PE 1800
The server is protected by antivirus nod32 and a harware firewall, so I am
quiet sure is not sasser worm.
It work as primary DC of a 15 client network, it also has WSUS service.
The other software installed is Dell Open manage.

Thank you for every help!
Alessandro

Tipo evento: Errore
Origine evento: Application Error
Categoria evento: (100)
ID evento: 1000
Data: 12/09/2006
Ora: 19.59.28
Utente: N/D
Computer: SERVER
Descrizione:
Applicazione che ha provocato l'errore lsass.exe, versione 5.2.3790.0,
modulo che ha provocato l'errore ntdll.dll, versione 5.2.3790.1830,
indirizzo errore
0x000224b2.
[ Faulting application lsass.exe, version 5.2.3790.0 , faulting module
ntdll.dll, versione 5.2.3790.1830 , version 0.0.0.0, fault address
0x000224b2
Dati:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 32 2e 33 37 39 30 2e .2.3790.
0028: 30 20 69 6e 20 6e 74 64 0 in ntd
0030: 6c 6c 2e 64 6c 6c 20 35 ll.dll 5
0038: 2e 32 2e 33 37 39 30 2e .2.3790.
0040: 31 38 33 30 20 61 74 20 1830 at
0048: 6f 66 66 73 65 74 20 30 offset 0
0050: 30 30 32 32 34 62 32 00224b2

Tipo evento: Errore
Origine evento: Winlogon
Categoria evento: Nessuno
ID evento: 1015
Data: 12/09/2006
Ora: 20.00.01
Utente: N/D
Computer: SERVER
Descrizione:
Il processo di sistema critico C:\WINDOWS\system32\lsass.exe non Ã¨ riuscito
e ha restituito il codice di stato c0000005. Riavviare il computer.
[A critical system process, C:\WINDOWS\system32\lsass.exe, failed with
status code c0000005. The machine must now be restarted]

Tipo evento: Informazioni
Origine evento: USER32
Categoria evento: Nessuno
ID evento: 1074
Data: 12/09/2006
Ora: 20.00.06
Utente: NT AUTHORITY\SYSTEM
Computer: SERVER
Descrizione:
Il processo winlogon.exe ha iniziato il Riavvio del computer SERVER per
conto dell'utente a causa di quanto segue: Impossibile trovare un titolo
per questo motivo
[The process winlogon.exe has initiated the restart of computer server on
behalf of user for the following reason: No title for this reason could
be found
Reason Code: 0x50006 Shutdown Type: restart ]

Codice causa: 0x50006
Tipo di arresto del sistema: Riavvio
Commento: Il processo di sistema "C:\WINDOWS\system32\lsass.exe" Ã¨
terminato in modo non previsto con codice di stato -1073741819. Il sistema
sarÃ* chiuso e riavviato..

[The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly
with status code -1073741819. The system will now shut down and restart." ]

0000: 06 00 05 00 43 00 3a 00 ....C.:.
0008: 5c 00 57 00 49 00 4e 00 \.W.I.N.
0010: 44 00 4f 00 57 00 53 00 D.O.W.S.
0018: 5c 00 73 00 79 00 73 00 \.s.y.s.
0020: 74 00 65 00 6d 00 33 00 t.e.m.3.
0028: 32 00 5c 00 4c 00 6f 00 2.\.L.o.
0030: 67 00 46 00 69 00 6c 00 g.F.i.l.
0038: 65 00 73 00 5c 00 53 00 e.s.\.S.
0040: 68 00 75 00 74 00 44 00 h.u.t.D.
0048: 6f 00 77 00 6e 00 5c 00 o.w.n.\.
0050: 53 00 68 00 75 00 74 00 S.h.u.t.
0058: 44 00 6f 00 77 00 6e 00 D.o.w.n.
0060: 5f 00 32 00 30 00 30 00 _.2.0.0.
0068: 36 00 30 00 39 00 31 00 6.0.9.1.
0070: 32 00 32 00 30 00 30 00 2.2.0.0.
0078: 30 00 30 00 32 00 2e 00 0.0.2...
0080: 78 00 6d 00 6c 00 00 00 x.m.l...

myweb · 22-09-2006

Hello Alessandro,

Sounds that you have problems with SASSER Virus. Did you have installed the
patch for Microsoft Security Bulletin MS04-011? Have a look at your Antivirus
vendors website.

http://www.microsoft.com/technet/sec.../ms04-011.mspx

Best regards

myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> The system process 'C:\WINDOWS\system32\lsass.exe' terminated
> unexpectedly with status code -1073741819. The system will now shut
> down and restart
>

myweb · 22-09-2006

Hello Alessandro,

2 Weeks ago we've had the same problems. AntiVirus didn't find anything.
We reinstalled the patch and it works.

Best regards

myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> I have a windows 2003 server that randomly reboot, about every 15
> days. In
> the event I found always the same errors
> (I add a english translation description between [] )
> Hardware is a Dell PE 1800
> The server is protected by antivirus nod32 and a harware firewall, so
> I am
> quiet sure is not sasser worm.
> It work as primary DC of a 15 client network, it also has WSUS
> service.
> The other software installed is Dell Open manage.
> Thank you for every help!
> Alessandro
> Tipo evento: Errore
> Origine evento: Application Error
> Categoria evento: (100)
> ID evento: 1000
> Data: 12/09/2006
> Ora: 19.59.28
> Utente: N/D
> Computer: SERVER
> Descrizione:
> Applicazione che ha provocato l'errore lsass.exe, versione 5.2.3790.0,
> modulo che ha provocato l'errore ntdll.dll, versione 5.2.3790.1830,
> indirizzo errore
> 0x000224b2.
> [ Faulting application lsass.exe, version 5.2.3790.0 , faulting module
> ntdll.dll, versione 5.2.3790.1830 , version 0.0.0.0, fault address
> 0x000224b2
> Dati:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 6c 73 61 ure lsa
> 0018: 73 73 2e 65 78 65 20 35 ss.exe 5
> 0020: 2e 32 2e 33 37 39 30 2e .2.3790.
> 0028: 30 20 69 6e 20 6e 74 64 0 in ntd
> 0030: 6c 6c 2e 64 6c 6c 20 35 ll.dll 5
> 0038: 2e 32 2e 33 37 39 30 2e .2.3790.
> 0040: 31 38 33 30 20 61 74 20 1830 at
> 0048: 6f 66 66 73 65 74 20 30 offset 0
> 0050: 30 30 32 32 34 62 32 00224b2
> Tipo evento: Errore
> Origine evento: Winlogon
> Categoria evento: Nessuno
> ID evento: 1015
> Data: 12/09/2006
> Ora: 20.00.01
> Utente: N/D
> Computer: SERVER
> Descrizione:
> Il processo di sistema critico C:\WINDOWS\system32\lsass.exe non Ã¨
> riuscito
> e ha restituito il codice di stato c0000005. Riavviare il computer.
> [A critical system process, C:\WINDOWS\system32\lsass.exe, failed with
> status code c0000005. The machine must now be restarted]
> Tipo evento: Informazioni
> Origine evento: USER32
> Categoria evento: Nessuno
> ID evento: 1074
> Data: 12/09/2006
> Ora: 20.00.06
> Utente: NT AUTHORITY\SYSTEM
> Computer: SERVER
> Descrizione:
> Il processo winlogon.exe ha iniziato il Riavvio del computer SERVER
> per
> conto dell'utente a causa di quanto segue: Impossibile trovare un
> titolo
> per questo motivo
> [The process winlogon.exe has initiated the restart of computer server
> on
> behalf of user for the following reason: No title for this reason
> could
> be found
> Reason Code: 0x50006 Shutdown Type: restart ]
> Codice causa: 0x50006
> Tipo di arresto del sistema: Riavvio
> Commento: Il processo di sistema "C:\WINDOWS\system32\lsass.exe" Ã¨
> terminato in modo non previsto con codice di stato -1073741819. Il
> sistema
> sarÃ* chiuso e riavviato..
>
> [The system process 'C:\WINDOWS\system32\lsass.exe' terminated
> unexpectedly with status code -1073741819. The system will now shut
> down and restart." ]
>
> 0000: 06 00 05 00 43 00 3a 00 ....C.:.
> 0008: 5c 00 57 00 49 00 4e 00 \.W.I.N.
> 0010: 44 00 4f 00 57 00 53 00 D.O.W.S.
> 0018: 5c 00 73 00 79 00 73 00 \.s.y.s.
> 0020: 74 00 65 00 6d 00 33 00 t.e.m.3.
> 0028: 32 00 5c 00 4c 00 6f 00 2.\.L.o.
> 0030: 67 00 46 00 69 00 6c 00 g.F.i.l.
> 0038: 65 00 73 00 5c 00 53 00 e.s.\.S.
> 0040: 68 00 75 00 74 00 44 00 h.u.t.D.
> 0048: 6f 00 77 00 6e 00 5c 00 o.w.n.\.
> 0050: 53 00 68 00 75 00 74 00 S.h.u.t.
> 0058: 44 00 6f 00 77 00 6e 00 D.o.w.n.
> 0060: 5f 00 32 00 30 00 30 00 _.2.0.0.
> 0068: 36 00 30 00 39 00 31 00 6.0.9.1.
> 0070: 32 00 32 00 30 00 30 00 2.2.0.0.
> 0078: 30 00 30 00 32 00 2e 00 0.0.2...
> 0080: 78 00 6d 00 6c 00 00 00 x.m.l...

Alessandro · 22-09-2006

Server has SP1, I've run then MBSA, it's does not indicate that ms04-011 is
missing but also It does not indicate that it need, so I suppose is included
in SP1.
I've manually checked some dll and theyr version are successive as indicated
in ms04-011 patch, so the server is OK about this patch

"myweb" <meiweb@gmx.de> ha scritto nel messaggio
news:59710d1068a8c8ac5bcb71aaf0@msnews.microsoft.com...
> Hello Alessandro,
>
> Sounds that you have problems with SASSER Virus. Did you have installed
> the patch for Microsoft Security Bulletin MS04-011? Have a look at your
> Antivirus vendors website.
>
> http://www.microsoft.com/technet/sec.../ms04-011.mspx
>
>
>
> Best regards
>
> myweb
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
>
>
>
>> The system process 'C:\WINDOWS\system32\lsass.exe' terminated
>> unexpectedly with status code -1073741819. The system will now shut
>> down and restart
>>
>
>