Re: A weird 'lsass' problem

Discussion in 'Computer Security' started by Bad Disciple, May 22, 2005.

  1. Bad Disciple

    Bad Disciple Guest

    Hi back,

    Here to say what happened.
    Actually, the procedures you've suggested seem perfectly correct,
    although I didn't have to go this way, I just re-installed ecerything
    but this time with Service Pack 2 which I downloaded from Microsoft.
    (http://www.microsoft.com/downloads/...BE-3B8E-4F30-8245-9E368D3CDB5A&displaylang=en)

    Actually, when the SP2's Firewall is ON, there are no 'lsass' attacks.
    If I block the Windows Firewall and leave only my other Firewall
    (Kaspesrky), the 'lsass' attacks start again. Kaspersky says it's
    'Lovesan' virus and successfully repulse it, but not sure for how long.
    So I keep the two Firewalls ON.

    On the other hand, it says that it's no good to have two or more
    Firewalls ON together... Is that right ? Go figure...

    Thanks anyway.
    Bad Disciple

    "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
    news:XH0ie.2755$rI1.2137@trnddc02...
    > From: "Bad Disciple" <>
    >
    > | Hi folks,
    > |
    > | Computer problems never stop... and damn weird problems.
    > | On a P3 computer, with Windows XP Pro, SP1, Antivirus
    > | and Firewall (Kaspersky) installed, I install the modem (DSL)
    > | and when I connect on Internet... it blocks in the first 1-2 min.
    > | A nasty box appears saying:
    > | "This system is shutting down. Save all your work...
    > | This shutdown was initiated by NT AUTHORITY\ SYSTEM.
    > | ... The system process Windows \System32\lsass.exe
    > | terminated unexpectedly with status code: 1073741819"
    > |
    > | After the computer restarted it says:
    > | "LSA SHELL (Export Version) encountered a problem and needs to close."
    > |
    > | I re-formatted the HD and re-installed Windows (with SP1).
    > | I typed 'shutdown -a' in 'run' as suggested. This worked just
    > | for a while. My Firewall was reporting repeatedly that
    > | there was an attack by 'lsass exploit' until finally it made again
    > | the blocking. Now even retyping 'shutdown -a' doesn't help,
    > | it blocks again every time when I connect to Internet. I made
    > | an antivirus scan (freshly updated), it reports NOTHING!
    > | I scanned it whit an antispy, it says there is NO spyware!!
    > |
    > | Another mind-blowing thing is that on my other computer
    > | (P4, with the same Windows XP Pro, but SP2, and the same
    > | Antivirus-Firewall, Kaspersky) I don't have this problem at all !!
    > |
    > | Incredibly pissing off... Seems like a damn well made
    > | worm or whatsoever ! (What will come after it ??)
    > | Could anybody help with what the hell is going on ?
    > | BD
    > |
    >
    > Dump the contents of the IE Temporary Internet Folder cache (TIF)
    > start --> settings --> control panel --> internet options --> delete files
    >
    > Dump the contents of the Mozilla FireFox Cache
    > Tools --> Options --> Privacy --> Cache --> Clear
    >
    > Obtain McAfee's virus and worm removal tool, Stinger:
    > http://vil.nai.com/vil/stinger/
    >
    > 1) If you are using WinME or WinXP, disable System Restore
    > http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
    > 2) Reboot your PC into Safe Mode and shutdown as many applications as
    > possible
    > 3) Using McAfee Stinger, perform a Full Scan of your platform and
    > clean/delete any
    > infectors found
    > 4) Restart your PC and perform a "final" Full Scan of your platform
    > 5) If you are using WinME or WinXP, Re-enable System Restore and
    > re-apply any
    > System Restore preferences, (e.g. HD space to use suggested 400 ~
    > 600MB),
    > 6) Reboot your PC.
    > 7) If you are using WinME or WinXP, create a new Restore point
    >
    > * * * Please report back your results * * *
    Bad Disciple, May 22, 2005
    #1
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Plz help

    lsass.exe has terminated system shutdown in 60secs

    Plz help, May 2, 2004, in forum: Computer Support
    Replies:
    3
    Views:
    6,979
    Plz help
    May 2, 2004
  2. bgordon
    Replies:
    3
    Views:
    15,258
    Reid Decker
    May 31, 2004
  3. drag

    lsass erro system needs to shut down

    drag, Sep 22, 2004, in forum: Computer Support
    Replies:
    2
    Views:
    1,707
    Plato
    Sep 22, 2004
  4. Bad Disciple

    A weird 'lsass' problem

    Bad Disciple, May 16, 2005, in forum: Computer Security
    Replies:
    2
    Views:
    812
    Bad Disciple
    May 22, 2005
  5. Bad Disciple

    A nasty 'lsass.exe' problem

    Bad Disciple, May 15, 2005, in forum: Computer Information
    Replies:
    9
    Views:
    485
    Robert Baer
    Jun 3, 2005
Loading...

Share This Page