Anilrgowda

Right here is my problem in the past couple of days (comming up to a week now) i have had my server repeatedly restart stating that lsass.exe has to failed and that the server needs to reboot to solve this problem. the error code it displays is 128.

On checking the event viewwe i get the following just before the server 'crashes':

1.
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 14/07/2005
Time: 18:36:49
User: N/A
Computer: XXXXXXX
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code 128. The machine must now be restarted.

For more information, see Help and Support Center at Events And Errors Message Center: Basic Search.

2.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1020
Date: 14/07/2005
Time: 18:21:42
User: NT AUTHORITY\SYSTEM
Computer: XXXXXX
Description:
Windows cannot create registry key Software\Microsoft\Windows\CurrentVersion\Group Policy. (Access is denied. ).

For more information, see Help and Support Center at Events And Errors Message Center: Basic Search.

Error 2 appears straight after error 1.

I am aware that lsass.exe can bring up problem 128 due to the sasser worm virus and it variants however i have scanned the computer and no viruses show up! The server is protected by a SPI Firewall (Kerio Winroute Firewall) and Symantec Corporate Antivirus.

The definitions for the antivirus are up to date.

Can someone please help me to solve this problem?

Any help is much appreciated.