Hi,

Sorry to jump in but I think 'C:\WINDOWS\system32\lsass.exe' is the sasser
virus.
This virus is known for rebooting pc’s so it would be my biggest bet that
this server is infected with the virus.

There is more info about it here:
http://forum.avast.com/index.php?topic=4067.msg30673 and on many other sites

Franky

From: firebird-support@yahoogroups.com
[mailto:firebird-support@yahoogroups.com] On Behalf Of Alexandre Benson
Smith
Sent: woensdag 23 augustus 2006 0:08
To: firebird-support@yahoogroups.com
Subject: Re: [firebird-support] Re: Problem when starting the FB service on
Win2003

Woody wrote:

> Alexandre,
>
> I am assuming someone has checked the system error log to see if anything

is

> listed there? Also, you can set a service to reboot the machine in case of
> failure. Perhaps one of the services is set this way which would cause the
> reboots?
>
> Woody (TMW)
>

Woddy and All,

Thanks for your time and responses.

As I told you, I wasn't the admin of that box, so I haven't looked
deeper on this issue...

I just know two things
1.) The server are rebooting without a clear cause (He told me the UPS
are overloaded and restarting)
2.) The FB service sometimes doesn't start because of a permission
problem (why just some times ???)

Well, now I decided to look a little deeper, but I didn't need to dig much.
Look at what I found on windows\system32\LogFiles\ShutDown\*
(I will put a translation below the portuguese message)
<ReasonTitle>Não foi encontrado um título para esta razão</ReasonTitle>
A Title for this reason was not found
<InitiatingProcess>winlogon.exe</InitiatingProcess>
<RestartDate>2006-8-21</RestartDate>
<RestartTime>10-48-29 (Hora oficial do Brasil(180))</RestartTime>
(BRazil official time)
<ReasonCode>0x50006</ReasonCode>
<RestartType>reiniciar</RestartType>
restart
<Comment>O processo do sistema 'C:\WINDOWS\system32\lsass.exe'
terminou inesperadamente com o código de status -1073740972. O sistema
será agora desligado e reiniciado.</Comment>
The system process 'C:\WINDOWS\system32\lsass.exe' stoped
unexpectedly with status code -1073740972. The system will be turned off
and restarted now.
<SystemUptime>2 19:39:23.375</SystemUptime>
<UserLanguageID>0x0416</UserLanguageID>
<SystemLanguageID>0x0416</SystemLanguageID>
<SchemaVersion>1.0</SchemaVersion>

There is 3 times the exactly same message yesterday e 4 times today.

For sure there is something wrong on the "software" side, a bad memory
could lead to such a message but not always the same processes.

Let's see if the "admin" look at this and discard the UPS :-))))

see you !

--
Alexandre Benson Smith
Development
THOR Software e Comercial Ltda
Santo Andre - Sao Paulo - Brazil
www.thorsoftware.com.br