WinXP Errors

[wingleaf]

hello Guys,

I got this error intermittently, i dont know if this was caused by sasser or blaster worm but i know that its not known issue in XPSP2 because of the patches it made to them.by the way can you help me with these kind of error,

The System Process: "C:\Winnt\System32\lsass.exe" terminated unexpectedly

with status code -1073741795.

The System Will Now Reboot

and also when i run spybot search and destroy under Tools>System Startup i see a blank key which the message is:

Current filename:

Database status: Not required - virus, spyware, malware or other resource hog

Value:

Filename: system32.exe

Description

Added by the _AGOBOT-KU_ WORM! Note - has a blank entry under the Startup Item/Name field

Source: Paul Collins Startup list

I search the net about these, and i found out that its name is for sophos

Name W32/Agobot-KU

Type Worm

Aliases Gaobot

Nortonbot

Phatbot

Polybot

Protection available since 19 July 2004 11:21:11 (GMT)

Included in our products from September 2004 (3.85)

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

"" = system32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

"" = system32.exe

but in the registry entry i found this

I already scan for virus using the latest updates, ad-aware, spybot but its seems its clean with them..

thanks for your help,

[Aegis]

I think the registry entries are null, meaning you can't view them with a regular registry editor. Try to see what turns up with RegNulDelete at the Sysinternals site.

[mini12]

Hello Wingleaf,

Go Start, Run, Type MSCONFIG

Select Startup Tab

Select the blank startup entry and unselect the tick box.

Press Apply and OK

Restart you computer

Tell me if the dialog appears again.

[JRosenfeld]

Apologies, what I posted is not relevant.

Edited July 24, 2006 by JRosenfeld

[Takeshi]

I've read this thread many times and am not sure what to make of it.

The graphic shows C:\WINDOWS\System32\lsass.exe but the text says C:\Winnt\System32\lsass.exe.

Lsass.exe authenticates users during logon and it's possible that something else apart from malware is causing this error.

Spybot found something but it does NOT prove that it is the cause of this error. I can't explain why you can't see it in the registry, but I doubt if having a null value is to blame. I'd have thought that the info you've found is not relevant or that Spybot has deleted it.

Edited July 25, 2006 by Takeshi

[cluberti]

The error message you see maps to "STATUS_ILLEGAL_INSTRUCTION", so I'd say it's likely that something else is passing a parameter or command to lsass.exe that is causing lsass.exe to bugcheck. I'd say do a thorogh virus sweep and spyware sweep (again) in safe mode, then reboot and run sfc /scannow to make sure that your system is using files that checksum from dllcache or the Windows CD, and see if the issue continues.