notebooks reboot during scan

[Peter_Selles]

Dear support team,

we are experiencing spontaneous reboots when Lansweeper tries to scan some notebooks. The errorlog.txt gives this error a large number of times:

22-4-2009 11:51:55: nb7479
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
at LansweeperService.MdlWmi.GetWMI(String Querystr, String Table, clsComputer& mycomputer, String section, SqlConnection& sqlcon)

In the eventlogs of the notebooks you can find these error messages:

Application log - WINLOGON: A critical system process, C:\WINNT\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

Security log - alot of logs for the account we use for Lansweeper:
Privileged object operation:
Object Server: Security
Object Handle: 3184
Process ID: 1124
Primary User Name: NB7479$
Primary Domain: SCHELDE
Primary Logon ID: (0x0,0x3E7)
Client User Name: zzLanSweeper
Client Domain: SCHELDE
Client Logon ID: (0x0,0x5B7CC4)
Privileges: SeTakeOwnershipPrivilege

System log - USER32: The process winlogon.exe has initiated the restart of NB7479 for the following reason: No title for this reason could be found
Minor Reason: 0x6
Shutdown Type: reboot
Comment: The system process 'C:\WINNT\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.

This problem can be replicated when I use lstrigger.exe to force a scan. Does anyone have an idea as to what this could be and how to solve it?

thanks in advance!

[Peter_Selles]

you've got mail 🙂

[Hemoco]

If possible could you send me the eventlog of the client by e-mail to lansweeper@hemoco.com

[Peter_Selles]

repairing WMI didn't help. The computers haven't rebooted since we disabled the Lansweeper service last wednesday. Today I restarted the service and the reboots started again and the script didn't help.

We checked with 2 different virusscanners and the computers where clean, so that shouldn't be the problem.
Any thoughts?

[Peter_Selles]

i first thought it would be Sasser too, the symptoms are similar. When we disable the Lansweeper service then the reboot go away. But thanks for the script. I will try it and get back to you with the feedback

[Hemoco]

When I Google the error I see various references to sasser worm,...
Have you tried repairing WMI on this machine?
Use this script to repair WMI on a computer.

[Peter_Selles]

when we implemented Lansweeper 3.5 about a month ago...we didn't connect the dots until now 🙂

[Hemoco]

When did this problem first started?

[Peter_Selles]

hi, we are running Windows XP with SP3.

I also noticed that this happens on at least one of our Dell dekstops, so it's not just the notebooks that have this problem.

[taeratrin]

What OS is running on these notebooks?