Lsass.exe terminated unexpectedly with status code -1073741819

[Simon Gronow]

I have this error and a Server reboot every 15mins, it seems to happen when
our PDC trys to send updates to the PBC

We are running W2k Server with Sp4


Any got any ideas ?


Thanks

 

[David H. Lipman]

It "may" be a virus as the the Lovegate worm or the Mofei worm attack lsass.exe.

Download and excute the McAfee worm removal tool, Stinger: http://vil.nai.com/vil/stinger/

Please read the following URLs and follow any instructions in them:
W32/MoFei.worm - http://vil.nai.com/vil/content/v_100357.htm
W32/Lovgate.a@M - http://vil.nai.com/vil/content/v_100085.htm

http://vil.nai.com/vil/content/v_100072.htm
http://vil.nai.com/vil/content/v_100183.htm
http://vil.nai.com/vil/content/v_100680.htm

If the above doesn't show anthyting, just in case -- Please go to McAfee
(http://www.mcafee.com/myapps/mfs/default.asp) and/or Trend
(http://housecall.antivirus.com ) and perform and online scan of your platform.

Please report back your findings

Dave



| I have this error and a Server reboot every 15mins, it seems to happen when
| our PDC trys to send updates to the PBC
|
| We are running W2k Server with Sp4
|
|
| Any got any ideas ?
|
|
| Thanks
|
|
|
|

 

[Eric Fleischman [MSFT]]

The first thing you'd want to do Simon is go to the latest lsass binaries:
828297 Memory Leak in Lsass.exe
http://support.microsoft.com/?id=828297

Don't mind the article itself, it is the fix itself you are interested in.
It rolls in some other fixes (most notably the one in q824226) that is most
interesting.

Give that a try if you would please, and post on back if that doesn't nail
it. I have a feeling it just might.

~Eric

 

[Simon Gronow]

Servers runs AV and it's update to date . We have also checked - no viruses

 

[Simon Gronow]

Applied these no change

The first thing you'd want to do Simon is go to the latest lsass binaries:
828297 Memory Leak in Lsass.exe
http://support.microsoft.com/?id=828297

Don't mind the article itself, it is the fix itself you are interested in.
It rolls in some other fixes (most notably the one in q824226) that is most
interesting.

Give that a try if you would please, and post on back if that doesn't nail
it. I have a feeling it just might.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

I have this error and a Server reboot every 15mins, it seems to happen when
our PDC trys to send updates to the PBC

We are running W2k Server with Sp4


Any got any ideas ?


Thanks

 

[Eric Fleischman [MSFT]]

Can you give us a bit more data? A path to a dump perhaps?
If not, I would suggest a call to PSS to get someone to debug this issue.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Applied these no change

The first thing you'd want to do Simon is go to the latest lsass binaries:
828297 Memory Leak in Lsass.exe
http://support.microsoft.com/?id=828297

Don't mind the article itself, it is the fix itself you are interested in.
It rolls in some other fixes (most notably the one in q824226) that is most
interesting.

Give that a try if you would please, and post on back if that doesn't nail
it. I have a feeling it just might.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

I have this error and a Server reboot every 15mins, it seems to happen when
our PDC trys to send updates to the PBC

We are running W2k Server with Sp4


Any got any ideas ?


Thanks

 

[Simon Gronow]

Hi Eric,


I jhave got MSS in Sydney Australia working on the issue, but this server
has been down for 5 days now and MSS are working on it, but not as quickly
as I would hope. I thought someone might have a quick fix


Rgds
Simon.

Can you give us a bit more data? A path to a dump perhaps?
If not, I would suggest a call to PSS to get someone to debug this issue.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Applied these no change

The first thing you'd want to do Simon is go to the latest lsass binaries:
828297 Memory Leak in Lsass.exe
http://support.microsoft.com/?id=828297

Don't mind the article itself, it is the fix itself you are interested in.
It rolls in some other fixes (most notably the one in q824226) that is most
interesting.

Give that a try if you would please, and post on back if that doesn't nail
it. I have a feeling it just might.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


I have this error and a Server reboot every 15mins, it seems to happen
when
our PDC trys to send updates to the PBC

We are running W2k Server with Sp4


Any got any ideas ?


Thanks

 

[Eric Fleischman [MSFT]]

If you do a go fixup on it does it find errors?

~Eric


--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric,


I jhave got MSS in Sydney Australia working on the issue, but this server
has been down for 5 days now and MSS are working on it, but not as quickly
as I would hope. I thought someone might have a quick fix


Rgds
Simon.

Can you give us a bit more data? A path to a dump perhaps?
If not, I would suggest a call to PSS to get someone to debug this issue.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Applied these no change


The first thing you'd want to do Simon is go to the latest lsass binaries:
828297 Memory Leak in Lsass.exe
http://support.microsoft.com/?id=828297

Don't mind the article itself, it is the fix itself you are

interested
in.

It rolls in some other fixes (most notably the one in q824226) that is
most
interesting.

Give that a try if you would please, and post on back if that

doesn't
nail

it. I have a feeling it just might.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


I have this error and a Server reboot every 15mins, it seems to happen
when
our PDC trys to send updates to the PBC

We are running W2k Server with Sp4


Any got any ideas ?


Thanks

 

[Simon Gronow]

It said it found some issues and said it fixed it, but still I get the same
issue, MS suggest to do a DCPROMO and take it away from being a PDC

If you do a go fixup on it does it find errors?

~Eric


--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric,


I jhave got MSS in Sydney Australia working on the issue, but this server
has been down for 5 days now and MSS are working on it, but not as quickly
as I would hope. I thought someone might have a quick fix


Rgds
Simon.

Can you give us a bit more data? A path to a dump perhaps?
If not, I would suggest a call to PSS to get someone to debug this issue.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


Applied these no change


The first thing you'd want to do Simon is go to the latest lsass
binaries:
828297 Memory Leak in Lsass.exe
http://support.microsoft.com/?id=828297

Don't mind the article itself, it is the fix itself you are interested
in.
It rolls in some other fixes (most notably the one in q824226)

that

is

most
interesting.

Give that a try if you would please, and post on back if that doesn't
nail
it. I have a feeling it just might.

~Eric

--
Eric Fleischman [MSFT]
This posting is provided "AS IS" with no warranties, and confers no
rights
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


I have this error and a Server reboot every 15mins, it seems to happen
when
our PDC trys to send updates to the PBC

We are running W2k Server with Sp4


Any got any ideas ?


Thanks

 

[Carl Frisk]

Try this:
http://www.jsiinc.com/SUBK/tip5400/rh5456.htm