2 Replies Latest reply on Sep 21, 2009 2:23 PM by jayner2020

    HIPS Causes PC restarts

      Hi,

      Today we have had several users who's pc's have displayed the error :

      A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

      and started a 60second count down to reboot.

      We currently only have a few users running HIPS, all of these have reported this issue.

      All errors from the event log at the time of the event are below, there is nothing in the log on the epo server:

      Event Type: Error
      Event Source: Winlogon
      Event Category: None
      Event ID: 1015
      Date: 09/09/2009
      Time: 15:47:39
      User: N/A
      Computer: *
      Description:
      A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

      Event Type: Error
      Event Source: Userenv
      Event Category: None
      Event ID: 1053
      Date: 09/09/2009
      Time: 15:47:40
      User: NT AUTHORITY\SYSTEM
      Computer: *
      Description:
      Windows cannot determine the user or computer name. (An internal error occurred. ). Group Policy processing aborted.

      Event Type: Information
      Event Source: SecurityCenter
      Event Category: None
      Event ID: 1807
      Date: 09/09/2009
      Time: 15:49:51
      User: N/A
      Computer: *
      Description:
      The Security Center service has been stopped. It was prevented from running by a software group policy.

      Event Type: Information
      Event Source: McLogEvent
      Event Category: None
      Event ID: 5000
      Date: 09/09/2009
      Time: 15:50:01
      User: NT AUTHORITY\SYSTEM
      Computer: *
      Description:
      McShield service started.
      Engine version : 5301.4018
      DAT version : 5735.0000

      Number of signatures in EXTRA.DAT : None
      Names of threats that EXTRA.DAT can detect : None


      Event Type: Information
      Event Source: USER32
      Event Category: None
      Event ID: 1074
      Date: 09/09/2009
      Time: 15:47:39
      User: NT AUTHORITY\SYSTEM
      Computer: *
      Description:
      The process winlogon.exe has initiated the restart of CB-WKS-MLEE for the following reason: No title for this reason could be found
      Minor Reason: 0x6
      Shutdown Type: reboot
      Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.


      Data:
      0000: 06 00 05 00 ....

      Event Type: Error
      Event Source: W32Time
      Event Category: None
      Event ID: 46
      Date: 09/09/2009
      Time: 15:48:22
      User: N/A
      Computer: *
      Description:
      The time service encountered an error and was forced to shut down. The error was: 0x800706BA


      Event Type: Information
      Event Source: Service Control Manager
      Event Category: None
      Event ID: 7036
      Date: 09/09/2009
      Time: 15:48:23
      User: N/A
      Computer: *
      Description:
      The Windows Time service entered the stopped state.

      Event Type: Error
      Event Source: Service Control Manager
      Event Category: None
      Event ID: 7023
      Date: 09/09/2009
      Time: 15:48:23
      User: N/A
      Computer: *
      Description:
      The Windows Time service terminated with the following error:
      An internal error occurred.


      Anyone have any ideas?

      Cheers

      Lloyd