1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

lsass.exe error

Discussion in 'Windows - Virus and spyware problems' started by yesser, Mar 6, 2007.

  1. yesser

    yesser Guest

    my compture pops up with thise first
    lsa shell export verson error, so i hit dont send on that,
    then i get a system shutdown and it counts down from some number and restarts
    sais this on there
    windows\system\32\lsass.exe
    code on there is 1073741819
    any idea on how to fix this? using windows xp pro
     
  2. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Hi,

    Press Start->Run and write this shutdown -a.

    Download HijackThis and post a logfile, please.
     
  3. yesser

    yesser Guest

    Logfile of HijackThis v1.99.1
    Scan saved at 2:16:21 PM, on 3/6/2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\WINDOWS\System32\explorer.exe
    C:\WINDOWS\System32\iexpolere.exe
    C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
    C:\Program Files\WinAntiSpyware 2007 Free\was7.exe
    C:\Program Files\Common Files\WinAntiSpyware 2007 Free\uwasdc.exe
    C:\Program Files\Common Files\WinAntiSpyware 2007 Free\uwasers.exe
    C:\Program Files\WinAntiSpyware 2007 Free\uwas7cw.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Defender\Defender Pro Firewall\KAVPF.exe
    C:\Documents and Settings\brad\Desktop\hijackthis\HijackThis.exe
    C:\Program Files\WinAntiSpyware 2007 Free\uwasffNT.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Defender\Defender Pro 2005\kav.exe /minimize
    O4 - HKLM\..\Run: [Antispy] C:\Program Files\Defender Pro\AntiSpy\Dpas.exe startup
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe
    O4 - HKLM\..\Run: [Services] C:\WINDOWS\System32\iexpolere.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program Files\WinAntiSpyware 2007 Free\was7.exe" /min
    O4 - HKLM\..\Run: [DC6_Check] "C:\Program Files\Common Files\WinAntiSpyware 2007 Free\uwasdc.exe"
    O4 - HKLM\..\Run: [ERS_Check] "C:\Program Files\Common Files\WinAntiSpyware 2007 Free\uwasers.exe"
    O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\WinAntiSpyware 2007 Free\uwas7cw.exe" -c
    O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\System32\vfhbfmrk.dll",setvm
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: Defender Pro Firewall.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: kavsvc - Kaspersky Labs - C:\Program Files\Defender\Defender Pro 2005\kavsvc.exe

     
  4. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Download sp1 here and install it.

    Download SDFix and save it to your Desktop.
    Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. DonĀ“t scan Yet.

    Go to Add/Rename applications and delete this:
    VSAdd-in

    Rename HijackThis.exe-->scanner.exe

    Open HijackThis, press do a system scan only, select this and press Fix checked:
    O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll

    Make a hidden files forward:
    1. Close all programs so that you are at your desktop.
    2. Double-click on the My Computer icon.
    3. Select the Tools menu and click Folder Options.
    4. After the new window appears select the View tab.
    5. Put a checkmark in the checkbox labeled Display the contents of system folders.
    6. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
    7. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
    8. Remove the checkmark from the checkbox labeled Hide protected operating system files.
    9. Press the Apply button and then the OK button and shutdown My Computer.
    10. Now your computer is configured to show all hidden files.

    Start your computer in safemode:
    # Restart your computer.
    # When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
    # Select the option for Safe Mode using the arrow keys.
    # Then press enter on your keyboard to boot into Safe Mode.

    Delete this folder:
    C:\Program Files\-->VSAdd-in<--

    * In Safe Mode, right click the SDFix.zip folder and choose Extract All, Sdfix exracts itselves to c:/sdfix -folder
    * Type Y to begin the script.
    * It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
    * Press any Key and it will restart the PC.
    * Your system will take longer that normal to restart as the fixtool will be running and removing files.
    * When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
    * Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back on to the forum with a new HijackThis log.
     
  5. yesser

    yesser Guest

    how do i do this? cant find the add/rename applcation

    Go to Add/Rename applications and delete this:
    VSAdd-in
     
  6. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Press start->controlpanel->Add/Remove application and delete this:
    VSAdd-in

    Did you found it?
     
  7. yesser

    yesser Guest

    yep i think that just fixed all of it right there
     
  8. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Can you send recent HjT-log and SDFix reports.
     
  9. yesser

    yesser Guest

    sorry my friend try to fix it by rebooting the whole computer and it did it again so hear is a new hijack file, thank you for your help

    Logfile of HijackThis v1.99.1
    Scan saved at 3:45:25 PM, on 3/7/2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\sysmgr64.exe
    C:\WINDOWS\wlmsngr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    C:\Program Files\Defender\Defender Pro Firewall\KAVPF.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Antispy] C:\Program Files\Defender Pro\AntiSpy\Dpas.exe startup
    O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Defender\Defender Pro 2005\kav.exe /minimize
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Resume Windows Update Installation.lnk = ?
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
    O4 - Global Startup: Defender Pro Firewall.lnk = ?
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O23 - Service: kavsvc - Kaspersky Labs - C:\Program Files\Defender\Defender Pro 2005\kavsvc.exe
    O23 - Service: sysmgr64 - Unknown owner - C:\WINDOWS\sysmgr64.exe
    O23 - Service: wlmsngr - Unknown owner - C:\WINDOWS\wlmsngr.exe

     
  10. yesser

    yesser Guest

    it restarted when i was using dvd shrink,dont know if that helps you have an idea at all
     
  11. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Please download F-Secure Blacklight (blbeta.exe) and save to your C:\ drive.
    1. Open a command window by going to Start > Run and typing: cmd
    2. Copy/paste or type the following in the command window:

    C:\blbeta.exe /expert

    3. Hit "Enter" to start the program and then close the cmd box.
    4. Accept the user agreement and click "Next".
    5 Click "Scan".
    6. After the scan is complete, click "Next", then "Exit". BlackLight will create a log in C:\ drive named "fsbl-xxxxxxx.log" (the xxxxxxx will be the date and time of the scan).
    7. The log will have a list of all items found. Do not choose to rename any yet! I want to see the log first because legitimate items can also be present...like "wbemtest.exe".
    8. Exit Blacklight and post the contents of the log in your next reply.

    Note: If you download Blacklight to your desktop, just double-click to run from there and it will create the "fsbl-xxxxxxx.log" on your desktop.

    Rename HijackThis.exe-->Scanner.exe

    Please run SDFix in safemode and post a logfile and new hijackthis logfile.
     
    Last edited: Mar 8, 2007
  12. yesser

    yesser Guest

    03/08/07 12:14:04 [Info]: BlackLight Engine 1.0.55 initialized
    03/08/07 12:14:04 [Info]: OS: 5.1 build 2600 ()
    03/08/07 12:14:04 [Note]: 7019 4
    03/08/07 12:14:04 [Note]: 7005 0
    03/08/07 12:14:10 [Note]: 7006 0
    03/08/07 12:14:10 [Note]: 7022 0
    03/08/07 12:14:10 [Note]: 7011 460
    03/08/07 12:14:11 [Note]: 7026 0
    03/08/07 12:14:12 [Note]: 7026 0
    03/08/07 12:14:12 [Note]: 7015 560
    03/08/07 12:14:12 [Note]: 7015 5
    03/08/07 12:14:12 [Note]: 7015 1448
    03/08/07 12:14:12 [Note]: 7015 5
    03/08/07 12:14:35 [Note]: FSRAW library version 1.7.1021
    03/08/07 12:16:29 [Note]: 7007 0



    SDFix: Version 1.69

    Run by Administrator - Thu 03/08/2007 @ 12:36:21.11

    Microsoft Windows XP [Version 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:

    Name:
    sysmgr64
    wlmsngr

    Path:
    "C:\WINDOWS\sysmgr64.exe"
    "C:\WINDOWS\wlmsngr.exe"

    sysmgr64 Deleted
    wlmsngr Deleted


    Logfile of HijackThis v1.99.1
    Scan saved at 12:47:36 PM, on 3/8/2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    C:\Program Files\Defender\Defender Pro Firewall\KAVPF.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator\Desktop\hijackthis\Scanner.exe.exe

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Antispy] C:\Program Files\Defender Pro\AntiSpy\Dpas.exe startup
    O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Defender\Defender Pro 2005\kav.exe /minimize
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Resume Windows Update Installation.lnk = ?
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
    O4 - Global Startup: Defender Pro Firewall.lnk = ?
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O23 - Service: kavsvc - Kaspersky Labs - C:\Program Files\Defender\Defender Pro 2005\kavsvc.exe

     
  13. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Download and install a firewall (only one) to your computer.

    I recommend one of these firewalls:
    Link
    Link
    Link

    Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
    http://www.ewido.net/en/download/
    [*]Install AVG Anti-Spyware by double clicking the installer.
    [*]Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    [*]On the main screen under Your Computer's security.
    [*]Click on Change state next to Resident shield. It should now change to inactive.
    [*]Click on Change state next to Automatic updates. It should now change to inactive.
    [*]Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    [*]Wait until you see the Update succesfull message.
    [*]Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update AVG Anti-Spyware.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

    Open HijackThis, press do a system scan only, mark these lines and press Fix checked:
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm


    [*]If the computer is running, shut down Windows, and then turn off the power.
    [*]Wait 30 seconds, and then turn the computer on.
    [*]Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    [*]Ensure that the Safe Mode option is selected.
    [*]Press Enter. The computer then begins to start in Safe mode.
    [*]Login on your usual account.

    Delete this file:
    C:\WINDOWS\web\-->related.htm<--

    Once in Safe Mode:

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    [*]Click on Scanner on the toolbar.
    [*]Click on the Settings tab.
    [*]Under How to act?
    [*]Click on Recommended Action and choose Quarantine from the popup menu.
    [*]Under How to scan?
    [*]All checkboxes should be ticked.
    [*]Under Possibly unwanted software:
    [*]All checkboxes should be ticked.
    [*]Under Reports:
    [*]Select Automatically generate report after every scan and uncheck Only if threats were found.
    [*]Under What to scan?
    [*]Select Scan every file.
    [*]Click on the Scan tab.
    [*]Click on Complete System Scan to start the scan process.
    [*]Let the program scan the machine.
    [*]When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    [*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    [*]At the bottom of the window click on the Apply all Actions button. (3)
    [​IMG]
    [*]When done, click the Save Scan Report button. (4)
    [*]Click the Save Report as button.
    [*]Save the report to your Desktop.
    [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware report.
     
    Last edited: Mar 9, 2007

Share This Page