XP pro shutting down by itself, no user intervention possible?

i was using my xp pro box tonite, just surfin the net and stuff like that when i got this popup box from the OS saying that nt authority\system has authorised a system shutdown, then about aminute later the computer shuts down for no reason at all, why would this happen?

i have some of the XP log files but im not really sure what it means

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1512
Date: 14/06/2003
Time: 7:55:23 PM
User: NT AUTHORITY\SYSTEM
Computer: PHROSTY-BOI-WIN
Description:
Windows cannot unload your registry file. The memory used by the registry has not been freed. This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account. If this problem persists, contact your administrator.

DETAIL - Insufficient system resources exist to complete the requested service.

i dont know what to make of it, before this happened i also got another error from some windows part:

Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 14/06/2003
Time: 7:54:22 PM
User: N/A
Computer: PHROSTY-BOI-WIN
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000006. The machine must now be restarted.

ive never had this happen to me before and have been considering a format of this machine for a while to start ona fresh new install, is this a good sign that i should be formatting soon?

I'm not sure what is causing your problems but xp by default will reboot when it encounters a problem. You can prevent this occuring by rightclicking on your desktop my computer icon. Then go to properties, under the avanced tab click startup and recovery settings button. Uncheck the restart check box in the system recovery section

If you look at the event viewer whilst connected to the internet and double click an event then click the hyperlink in the dialogbox that appears you may find some more info about the problems you are having.

Xp doesn't like being re-installed,you may have to reactivate the os if you go0 down this road.

no its not like that type of reboot, this was like the type of message that you can send across a network, i wish i coulda got a screenie of it to better explain myself, it actually counted down from 60 secs like it was initiated by an admin or something, but im the only admin on the computer and i have AV and firewall, maybe it was just a freak system error?

Quote:

---

DETAIL - Insufficient system resources exist to complete the requested service.

---

Sounds to me like you ran out of memory. All your ram was in use and it didn't have anymore resourses.
But, I could be way off too.

I found a question/answer relating to a similar problem in Windows 2000, though it seems that the user here had a much worse case of what you're seeing. Windows 2000 and XP are similar enough behind the gui that this might pertain to your situation. Do you have all your patches up to date? Had you installed any new patches shortly before this reboot occurred?

https://lists.aas.duke.edu/pipermail...ay/000668.html
https://lists.aas.duke.edu/pipermail...ay/000669.html

Edit: The reason I'm focusing on the second log entry is that it appears that the sudden shutdown of the system caused the first entry to appear. Therefore I'm betting that the log entry about the registry not being freed is a symptom, not the real problem. The following webpage might also prove useful if you're not fully patched.

http://www.immunitysec.com/downloads/plonk.txt

moxnix, you have a very good point there, i remember that someone told me that a mag i read a while back said that with XP pro you can set your swapfile as low as 128 meg fixed size, tried it with no problems, but now that this has happened i've set it back to 512 fixed value, aybe it was a lack of 'virtual' memory that made it unhappy

BTW i have 512meg actual RAM in the system

You may have a bad fan on the CPU or a Power supply fan
that has died....
99% of my XP shutdowns are usually that...
I even had one that the CPU fan from the motherboard
MFG was not big enough....

Time for a new fan for the CPU or a new Power Supply

Dear you were knocked by the following tool

RPCNUKE by Lion find it at www.immunitysec.com or at packetstormsecurity.nl
to avoid this turn off NetBios Over TCP

or

Just a power failure :(

warl0ck7
.::No Remorse::.

Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 14/06/2003
Time: 7:54:22 PM
User: N/A
Computer: PHROSTY-BOI-WIN
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000006. The machine must now be restarted.

lsass.exe is part of the Windows 2000 & Windows XP Kernel... If ANY of your Kernel processes fail, your system will have to be rebooted or it becomes unstable...XP detects this, and restarts the system automatically if necessary... This is an extremely good option that should not be turned off... If you do, and this happens again, you risk losing ANYTHING that has not been saved... Most likely this is something that will not happen again... If it does you may need to repair your system... If you need to do this, boot using the XP cd and choose to repair windows... once it is working correctly, use the backup utility to create a backup and an ASR (Automated System Recovery) disk.

DRJ Dear lsass is not a part of Windows NT kernel read below to gain more information

1. LSASS is Local Security Accounts Manager,it maintains the SAM and the LSA policy.
2. LSASS cannot be terminated just like that.(kill from NTRESKIT Needed)
3. Something weird is happening on the machine or just a motherboard problem

[shadow] warl0ck7
.::No Remorse::. [/shadow]

Quote:

---

Originally posted here by mrleachy
moxnix, you have a very good point there, i remember that someone told me that a mag i read a while back said that with XP pro you can set your swapfile as low as 128 meg fixed size, tried it with no problems, but now that this has happened i've set it back to 512 fixed value, aybe it was a lack of 'virtual' memory that made it unhappy

BTW i have 512meg actual RAM in the system

---

With that amount of physical memory, you should be able to disable virtual memory altogether. This will increase your system performance. if you do have to have a swap file, make the start and end size the same, that way, windows doesn't have to continually resize the pagefile. This trick has always resulted in increased performance for me.


--PuRe

WarLock - Thanks for the link. It answers 'why' my router(s) keep getting hit with port 445 requests/attacks.