cancel
Showing results for 
Search instead for 
Did you mean: 
lloydy
Level 7

HIPS Causes PC restarts

Hi,

Today we have had several users who's pc's have displayed the error :

A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

and started a 60second count down to reboot.

We currently only have a few users running HIPS, all of these have reported this issue.

All errors from the event log at the time of the event are below, there is nothing in the log on the epo server:

Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 09/09/2009
Time: 15:47:39
User: N/A
Computer: *
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1053
Date: 09/09/2009
Time: 15:47:40
User: NT AUTHORITY\SYSTEM
Computer: *
Description:
Windows cannot determine the user or computer name. (An internal error occurred. ). Group Policy processing aborted.

Event Type: Information
Event Source: SecurityCenter
Event Category: None
Event ID: 1807
Date: 09/09/2009
Time: 15:49:51
User: N/A
Computer: *
Description:
The Security Center service has been stopped. It was prevented from running by a software group policy.

Event Type: Information
Event Source: McLogEvent
Event Category: None
Event ID: 5000
Date: 09/09/2009
Time: 15:50:01
User: NT AUTHORITY\SYSTEM
Computer: *
Description:
McShield service started.
Engine version : 5301.4018
DAT version : 5735.0000

Number of signatures in EXTRA.DAT : None
Names of threats that EXTRA.DAT can detect : None


Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 09/09/2009
Time: 15:47:39
User: NT AUTHORITY\SYSTEM
Computer: *
Description:
The process winlogon.exe has initiated the restart of CB-WKS-MLEE for the following reason: No title for this reason could be found
Minor Reason: 0x6
Shutdown Type: reboot
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.


Data:
0000: 06 00 05 00 ....

Event Type: Error
Event Source: W32Time
Event Category: None
Event ID: 46
Date: 09/09/2009
Time: 15:48:22
User: N/A
Computer: *
Description:
The time service encountered an error and was forced to shut down. The error was: 0x800706BA


Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 09/09/2009
Time: 15:48:23
User: N/A
Computer: *
Description:
The Windows Time service entered the stopped state.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 09/09/2009
Time: 15:48:23
User: N/A
Computer: *
Description:
The Windows Time service terminated with the following error:
An internal error occurred.


Anyone have any ideas?

Cheers

Lloyd
0 Kudos
2 Replies
SergeM
Level 9

RE: HIPS Causes PC restarts

I believe this ought to be in the "IDP & Spyware" sub-forum...
Perhaps one of the mods might move it there ?

thanks
Serge
0 Kudos
jayner2020
Level 7

I get the same thing as well

is there a solution to this issue? i have several users that have this happening. No viruses found but they did recently have HIPS installed.
0 Kudos