Drew, I work for Microsoft doing support for incidents such as this. My support group is not aware of any such issues.
The error code -1073741819 is an access violation. An access violation, if unhandled by the service's code, would cause the service to be terminated. If an access violation occurs in a service that is required for the OS to run, the termination of the service would cause the machine to reboot. (That's an oversimplified explanation.) Please open a support case with Microsoft so that we can get this issue properly troubleshooted (troubleshot?). If you would like, you may email me privately and I'll open a support case and work with you on this. -Matt -----Original Message----- From: Drew Weaver [mailto:[EMAIL PROTECTED] Sent: Monday, March 13, 2006 1:15 PM To: [email protected] Subject: New Sasser variant on the loose? Anyone else? Has anyone seen a sasser variant that effects Windows 2k3 SP1? We have started seeing servers exhibiting the exact same effects that sasser had back when it was "all the rage" that are completely patched to the latest "Windows Update" spec before ever touching the non firewalled internet. Our firewall is about as restrictive as possible. There are two errors which are similar which evoke the "reboot of death" I have been seeing these again since Saturday. "Shutdown was initiated by NT AUTHORITY\SYSTEM C:\Windows\SYSTEM32\services.exe Status Code -1073741819" I shortened the above error message, but the perinent parts are there, I also noticed that sometimes it is lsass and sometimes it is services.exe. Also, we use ghost to install our operating system, and our ghost image is current up to the last windows update patch, and I have verified that sasser is not on our ghost image. Has anyone seen anything similar? Thanks, Andrew --------------------------------------------------------------------------- --------------------------------------------------------------------------- --------------------------------------------------------------------------- ---------------------------------------------------------------------------
