[mraj27]

Hi,
Iam using 2000 server operating system, here iam giving my system's specifications.

320MB RAM
400 MHG PROCESSOR( X86 FAMILY)
20GB HDD

My system is shutting down suddenly by giving a warning message as

[email protected] " save the things, your system is shutting down, due to d:\winnt\system32\lsass.exe terminated unexpectedly with status code 128."

please let me know what could be the problem?

Regards,
Raj

[Advertisements]

This is often caused by a virus. The version I have come across uses a remote procedure call (RPC) so to stop it shutting your system down long enough to fix it, the first step is to stop and disable the RPC service in Control Panel=>Administrative tools=>Services. Scroll down the list of services til you find RPC and right click on it. Select 'Properties' from the menu. Change the startup option from automatic to disabled, and also click 'stop'. This should prevent the virus from shutting down.
Now you should have time to run your antivirus software and zap the nasty!!

On a home system almost no apps use RPC so it is perfectly safe to leave it switched off. While you are in there you can also disable Messenger Service which will stop any those annoying Windows Messenger popups

[senshisteph]

This is often caused by a virus. The version I have come across uses a remote procedure call (RPC) so to stop it shutting your system down long enough to fix it, the first step is to stop and disable the RPC service in Control Panel=>Administrative tools=>Services. Scroll down the list of services til you find RPC and right click on it. Select 'Properties' from the menu. Change the startup option from automatic to disabled, and also click 'stop'. This should prevent the virus from shutting down.
Now you should have time to run your antivirus software and zap the nasty!!

On a home system almost no apps use RPC so it is perfectly safe to leave it switched off. While you are in there you can also disable Messenger Service which will stop any those annoying Windows Messenger popups

[mraj27]

Dear Senshisteph,
Thanks alot for ur suggestion, but i have some doubt, The problem is due to termination of the file " lsass.exe." and that has been assigened to the service IPSEC plicy Agent.


means, IPSEC policy Agent service is having executable path as D:\WINNT\System32\lsass.exe.

Remote Procedure Call (RPC) service contains the executable path is D:\WINNT\system32\svchost -k rpcss

Remote Procedure Call (RPC) Locator service contains the executable path as D:\WINNT\System32\locator.exe

Is there any need to disable the service IPSEC polocy Agent along with Remote procedure call and Remote Procedure Call Locator. as it is having the file lsass.exe

please clear my doubt.

Thanks & Regards,
Raj

[senshisteph]

May be a different virus - that way always worked for me but viruses change, or it may be something else altogether. Hmm....

Anyone else any ideas?