Server Tips > Windows Server > lass.exe error

Windows 2003 Server Shutting down - lass.exe

On windows 2003 server, when login to the server, it shows following error message and restart itself

The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITYSYSTEM. Shutdown will begin in 47 seconds. Shutdown messages: The system process `C:\ Windows\system32\lsass.exe` terminated unexpectedly with status code - 1073741819. The system will now shut down and restart..

The problem is the server infected with worm/virus called W32/Sasser.

Once login, it shows error, saying server is going to reboot. I stoped the reboot process with

Start > Run > cmd
shutdown -a

After doing this, i can work on the server, but server is not working properly, for example, control panel is not working, Local users and group shows as disabled.

How I Fixed the Problem

I know a client who faced same problem and ThePlanet.com Datacenter asked them to do an OS restore and i have done the HELM web site restore for them. So i want to avoid going that path. I tried 3 different software to fix the problem. After two days of trail, i have solved the problem and server is working normal now. The tools i used to fix the problem are below

McAfee AVERT Stinger

I think this one actually fixed my problem. It can find several worms/trojans. You can download it from

Microsoft® Windows® Malicious Software Removal Tool

Next i tried Microsoft® Windows® Malicious Software Removal Tool. But it seems McAfee AVERT Stinger already fixed the problem, when i try this, there was no reboot problem present, still i need to make sure. You can download Microsoft® Windows® Malicious Software Removal Tool from

Symantec FxSasser.exe

I also run this on my server after the problem. I suggestyou should try this one also. You can find more details at

You can find more finformation about the worm from Microsoft web site, What You Should Know About Sasser