Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lsa Shell - Continuous Reboot/user Account Error


  • Please log in to reply
5 replies to this topic

#1 iheartmycomputer

iheartmycomputer

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:48 AM

Posted 07 December 2005 - 08:40 PM

:thumbsup:

Randomly --- The LSASS.EXE error/worm/whatever issue started occurring. Upon start-up, the error message would pop-up and the computer would reboot in 60 seconds. I am able to stop it by using the command prompt (shutdown.exe -a). That's about as far as I've gotten though.

I was also able to scan it on microsoft.com and it was declared to be free of malicious software (yeah, right).

I have the following symptoms...

- Since this error started occurring, the computer boots in a different manner (i.e. my visual settings don't have that same bubbly 'XP' look as they did before --- it looks like safe mode but isn't (???)). When I'm in this mode, I cannot shut down. I click start and the only option is 'log off' which usually takes 15 minutes to do. When I do boot in safe mode, the same thing occurs if I log in as my account (not the default admin account that is available in safe mode)

- While in safe mode, I was able to run some of my Norton anti-virus/spyware, etc. but it's all out of date :flowers: I decided to search for lssase.exe and found several occurrences of it. I deleted all but those found in windows\system32\etc.....not that that's probably very effective.

- Also, I'm having user issues...I tried to use system restore and received a message stating that I didn't have the authority and had to contact the administrator (even though my user name is administrator). In safe mode - logged on as administrator - I tried to use system restore and kept getting the "system restore must close" error.

- Lastly, I frequently receive the message that the LSA Shell needs to close, yada, yada, yada. This most frequently occurs when I am in the command prompt trying to stop the 60 second shut down count down.


Ugh. Can anyone help?

BC AdBot (Login to Remove)

 


#2 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:08:48 AM

Posted 07 December 2005 - 08:43 PM

http://securityresponse.symantec.com/avcen...moval.tool.html
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#3 iheartmycomputer

iheartmycomputer
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:48 AM

Posted 07 December 2005 - 09:27 PM

Ran the symantec test...worm32 not found...

#4 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:08:48 AM

Posted 07 December 2005 - 10:21 PM

Get HiJack This V1.99.1 http://thespykiller.co.uk/files/hijackthis_sfx.exe - double click the DL file and click UNZIP letting it extract to its default folder C:\Program FIles\HiJackThis, run it from there, DO NOT fix anything, post the log here.
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#5 Joshuacat

Joshuacat

    01001010 01000011


  • Members
  • 1,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ontario, Canada
  • Local time:09:48 AM

Posted 07 December 2005 - 10:34 PM

Do not post your log in this forum.
Post your HiJackthis log in our HijackThis Logs and Analysis forum.
Before you do, please read and follow the instructions in the Preparation Guide for use before posting a HijackThis Log

Good-Luck.

Edited by Joshuacat, 07 December 2005 - 10:35 PM.

JC

#6 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:08:48 AM

Posted 07 December 2005 - 10:39 PM

Ooops - You're right post in the HJT form as indicated (Got to get used to how things are done here - Sorry!)
"Nothing could be finer than to be in South Carolina ............"

Member ASAP




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users