This topic is locked
So I bought a new video card yesterday, installed it, overclocked it, and benchmarked it like I always do. The only apps I used were EVGA precision, Furmark, and the Crysis demo.
I restarted the computer and it worked fine for the first couple of reboots. Then, one time I started it up after a couple of hours, and I was greeted with a desktop with no icons, taskbar, or anything. Explorer.exe was running, but then I ended it and started a fresh process. Everything came up and worked fine.
After doing some research, I found out it had something to do with my registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and then the value of Shell). Mine says Explorer.exe "C:\Users\Randall\AppData\Roaming\lsass.exe", but apparently it's just supposed to read "explorer.exe". After changing it, the system boots up perfectly, but the value is reset to the one that was causing me trouble.
This is how lsass.exe (isn't that supposed to be in the System32 folder? o_o) turns out on Virustotal:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.27 -
AhnLab-V3 5.0.0.2 2010.03.27 -
AntiVir 7.10.5.241 2010.03.26 -
Antiy-AVL 2.0.3.7 2010.03.26 -
Authentium 5.2.0.5 2010.03.27 -
Avast 4.8.1351.0 2010.03.27 -
Avast5 5.0.332.0 2010.03.27 -
AVG 9.0.0.787 2010.03.27 -
BitDefender 7.2 2010.03.27 -
CAT-QuickHeal 10.00 2010.03.27 -
ClamAV 0.96.0.0-git 2010.03.27 -
Comodo 4405 2010.03.27 -
DrWeb 5.0.1.12222 2010.03.27 -
eSafe 7.0.17.0 2010.03.25 -
eTrust-Vet 35.2.7391 2010.03.26 -
F-Prot 4.5.1.85 2010.03.26 -
F-Secure 9.0.15370.0 2010.03.27 -
Fortinet 4.0.14.0 2010.03.27 -
GData 19 2010.03.27 -
Ikarus T3.1.1.80.0 2010.03.27 -
Jiangmin 13.0.900 2010.03.27 -
K7AntiVirus 7.10.1004 2010.03.22 -
Kaspersky 7.0.0.125 2010.03.27 -
McAfee 5933 2010.03.27 -
McAfee+Artemis 5933 2010.03.27 -
McAfee-GW-Edition 6.8.5 2010.03.27 -
Microsoft 1.5605 2010.03.27 -
NOD32 4978 2010.03.26 -
Norman 6.04.10 2010.03.27 -
nProtect 2009.1.8.0 2010.03.27 -
Panda 10.0.2.2 2010.03.27 -
PCTools 7.0.3.5 2010.03.27 -
Prevx 3.0 2010.03.27 -
Rising 22.40.05.04 2010.03.27 -
Sophos 4.52.0 2010.03.27 -
Sunbelt 6101 2010.03.26 -
Symantec 20091.2.0.41 2010.03.27 Suspicious.Insight
TheHacker 6.5.2.0.246 2010.03.27 -
TrendMicro 9.120.0.1004 2010.03.27 -
VBA32 3.12.12.2 2010.03.27 -
ViRobot 2010.3.27.2248 2010.03.27 -
VirusBuster 5.0.27.0 2010.03.27 -
So basically 1/42, leading me to believe it's a false positive.
This is my Hijack This log:
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 9:53:33 AM, on 3/28/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\explorer.exe
C:\Windows\SoundMan.exe
C:\Windows\alcwzrd.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\FileHippo.com\UpdateChecker.exe
C:\Windows\explorer.exe
C:\Program Files\AltDrag\AltDrag.exe
C:\Volume.exe
C:\Program Files\Greenshot\Greenshot.exe
C:\Users\Randall\AppData\Roaming\lsass.exe
C:\Users\Randall\AppData\Roaming\lsass.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\regedit.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Randall\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\HiJack This\TrendMicro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe "C:\Users\Randall\AppData\Roaming\lsass.exe"
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Randall\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [EVGAPrecision] "C:\Program Files\EVGA Precision\EVGAPrecisionWrapper.exe" /s
O4 - HKLM\..\Run: [MSWUpdate] "C:\Users\Randall\AppData\Roaming\lsass.exe"
O4 - HKCU\..\Run: [Google Update] C:\Users\Randall\AppData\Local\Google\Update\GoogleUpdate.exe /c
O4 - HKCU\..\Run: [FileHippo.com] "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background
O4 - HKCU\..\Run: [AltDrag] "C:\Program Files\AltDrag\AltDrag.exe"
O4 - HKCU\..\Run: [MSWUpdate] "C:\Users\Randall\AppData\Roaming\lsass.exe"
O4 - HKCU\..\Run: [SuperbarMonitor.Volume] "C:\Volume.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Greenshot.lnk = C:\Program Files\Greenshot\Greenshot.exe
O4 - Startup: slui.lnk = C:\Windows\System32\slui.exe
O8 - Extra context menu item: Download All By FlashGet3 - C:\Users\Randall\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download By FlashGet3 - C:\Users\Randall\AppData\Roaming\FlashGetBHO\GetUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://software.kuaiche.com
O15 - Trusted IP range: http://192.168.1.1
O15 - ESC Trusted IP range: http://192.168.1.1
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s...el_4.1.66.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C00E0456-F4F7-47B3-B628-A7739BA29A23}: NameServer = 156.154.70.1,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{C00E0456-F4F7-47B3-B628-A7739BA29A23}: NameServer = 156.154.70.1,192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{C00E0456-F4F7-47B3-B628-A7739BA29A23}: NameServer = 156.154.70.1,192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxea_device - - C:\Windows\system32\lxeacoms.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
--
End of file - 8920 bytes
Starting a new user account and logging into it gives me an error about lsass.exe.
Could someone help me figure out what's wrong with my machine?
Edited by elise025, 28 March 2010 - 12:56 PM.
Since a log is posted, I am moving this to the appropriate forum ~ Elise
Back to top
