|
Register | Sign In |
|
QuickSearch
Thread ▼ Details |
|
Thread Info
|
|
|
Author | Topic: HELP | |||||||||||||||||||||||||||||
mike the wiz Member Posts: 4752 From: u.k Joined: |
Hi there.
My computer/net has goosed. So...., I desire a computer expert to determine my future existence at this site. Apparently, Queen Asgara is a computer wiz, hence - I command her input. Now, I have 3 minutes on the web before the system shuts down. I have tried for a week to fix it despite my none-skills at pcing. "system shutting down" to restart, and then it counts a minute and restarts. This gives no options for the restart, and nothing stops the process. Well, what can I say, I've had to type this message in notepad cos I've only got three minutes to log in and make this topic... I hope someone knows about pc problems. Also, I will only be able to return to this site and read your message for.....3 minutes. SO, this might be fun afterall, but I'm a slow reader and it's a bummer if no one has a clue just like me. I mean, I've reinstalled windows, and the web logs on just fine, and I can even go from site to site, yet the activation of the web seems to cause this problem which always happens within 3 minutes of surfing. So,... I'm stumped. Anyone ever heard of "lsa shell export"? This seems to pop up and asks "send error report"?? and when I press "don't send" this "shutting down" thing happens, whether I ignore the "lsa shell" thing or not, the shutting down process will happen about half a minute later. Yet no explanation is given????? Grrrrr. Can such a system shut down be stopped in any way?. Yes, I've tried alt+ctrl+delete. Please don't ask me any questions - just solve my problem you useless goons as it will take me 3 minutes to read your post probably, that's if anyone reads this lame topic. PS. Can someone please bump this topic for me, when it is gone from the "list all topics". Thanks..., and keep your baba good. Oh well, put me in the Holmes section cos it looks like I'm gonna be gone for a loooooong time.I blame Asgara. And Lam aswell, Cos he called me a hybrid, and there's a conspiracy to rid me from the evc..
|
|||||||||||||||||||||||||||||
jar Member (Idle past 394 days) Posts: 34026 From: Texas!! Joined: |
You have sinned and are being punished for disparaging the Holy Name of Asgara.
You have one of the viruses. Start up in safe mode and run your anti-virus software. Aslan is not a Tame Lion
|
|||||||||||||||||||||||||||||
Lindum Member (Idle past 3397 days) Posts: 162 From: Colonia Lindensium Joined: |
Sounds like sasser... try this link and download the microsoft fix - it's only small so you should have time!
|
|||||||||||||||||||||||||||||
NosyNed Member Posts: 8996 From: Canada Joined: |
It sounds like you have the blaster worm.
You might be able to keep things up long enough to get it out of there if you reboot in VGA mode. For some reason that worked on my Dads PC. If not it gets harder. If you google "blaster worm" you should find lots of places to help. Microsoft Corporation has information on it. If you can post the exact message you're getting then we might be able to confirm the blaster
|
|||||||||||||||||||||||||||||
Melchior Inactive Member |
Since it only happens when you go online, it does indeed seem like one of the worms that uses security holes in WinXP/2k to crash certain critical programs.
If you are using Windows XP, I suggest you try one thing first. Go to start->settings->network connections->Local area network (or similar)->advanced->enable firewall->OK. If the problems stops after this, you can easily download the security updates for Windows to remove the problem fully. Always run checks on your computer afterward. This message has been edited by Melchior, 07-04-2004 02:19 PM
|
|||||||||||||||||||||||||||||
Brad Member (Idle past 4788 days) Posts: 143 From: Portland OR, USA Joined: |
Or, when you first get on, go download zonealarm, after that program is installed it asks you if you want to allow programs internet access, for some reason the blaster worm requires internet access, so if you don't allow access to anything that you don't know what it is then you should be able to restrict blaster's access long enough to get a patch. Also this makes it less stressful to get a patch for it. At least that's what I did. Hope it helps.
-Brad |
|||||||||||||||||||||||||||||
NosyNed Member Posts: 8996 From: Canada Joined: |
The firewall should stop the blaster from getting in. But I didn't think it would affect it once it is in there.
|
|||||||||||||||||||||||||||||
Melchior Inactive Member |
There are some non-worms that regularily uses certain exploits in the OS. The only thing they do is crash your computer, but don't actually infect it. I had a lot of problems with that some time ago.
It could be a worm, in which case he should be able to detect it via anti-virus or anti-spyware programs. The thing is, computers infected with most Blaster variants (especially the ones first developed) show very well that they are messed up. They start running very very slow, and messes up connection to things such as IRC and such. If the computer works perfectly fine up until the shutdown, I think it's something else.
|
|||||||||||||||||||||||||||||
Melchior Inactive Member |
Btw, since it seems to target lsass, it probably is Sasser as Lindum figured, which can both act as a normal worm and infect the computer, or if that's not directly possible, still crash a computer whenever it's online.
Still, all variants can be fixed by first firewalling the computer to prevent shutdowns, then download and run the various fixes/searches. This message has been edited by Melchior, 07-04-2004 02:34 PM
|
|||||||||||||||||||||||||||||
Trixie Member (Idle past 3706 days) Posts: 1011 From: Edinburgh Joined: |
Mike, your puter is doing exactly what the Blaster-infected ones did - I cleaned loads of those machines, mainly because I didn't get it so I was able to download the fix and put it on floppies for people. I've sent you an e-mail with the fix tool attached. Unfortunately its got a .exe extension, so if you use Outlook to download your e-mail it may get refused. If that happens let me know and I'll try changing the file extension to something nonsensical and send it again. Good luck. By the way, get ZoneAlarm as soon as you can get online long enough. Its free to download the personal version and so are the updates, its a really good firewall, works a dream. I think that's why I didn't get blaster in the first place.
|
|||||||||||||||||||||||||||||
jar Member (Idle past 394 days) Posts: 34026 From: Texas!! Joined: |
One other thing to check.
If you are running windows 2000 there is a well known problem that will give you exactly those symptoms.
See this link Aslan is not a Tame Lion |
|||||||||||||||||||||||||||||
Melchior Inactive Member |
Mmm, Zone Alarm will automatically block all those exploits. The only problem is that the free version is just a 30 day trial version, and it does take quite a bit of resources compared to a hardware firewall.
Definitely better than leaving your computer wide open, though, and relatively easy to setup even if you haven't used a firewall before.
|
|||||||||||||||||||||||||||||
mike the wiz Member Posts: 4752 From: u.k Joined: |
Guys, here's the 2 messages. The first says;
"LSA export version has encountered a problem and needs to close" Then, whether I press "don't send" or just ignore it, it then displays this message; "This system is shutting down. Please save all work in progress....This shutdown was initiated by NT AUTHORITY\SYSTEM.....The system process was system 32\lsass.exe." Now to me, that might aswell be written in Japenese with my pc skill - lack thereof. Thanks so far guys. I have read your messages and am reading about two messages per webtime. I have tried the firewall to no evail. I have downloaded the small anti-virus package and it says "detected no virus", and I have rebooted in VGA mode. None have worked unfortunately, but I am grateful for all suggestions, and will most desperately try anything. Although it is getting very difficult to read now as it seems to be getting less time. I have about a minute and a half now. Did Trixie say she emailed me? (I am writing this post in notepad) My new email is Thewispo2004@yahoo.co.uk. I am sorry if you sent to my old email. I will check my new email address, and hope I can get to the email in time, but for now, this is just so difficult to read this topic. It's shutdown about ten times already. Thanks to everyone, I will try all suggestions, but do remember I am a pc twit.
|
|||||||||||||||||||||||||||||
Lindum Member (Idle past 3397 days) Posts: 162 From: Colonia Lindensium Joined: |
Mike, I've emailed you the latest version of Stinger from Mcaffee anti-virus - it will hopefully fix the problem. Just make sure you don't go online when you run it! If the email doesn't work you can get the program here: http://vil.nai.com/vil/stinger/
|
|||||||||||||||||||||||||||||
mike the wiz Member Posts: 4752 From: u.k Joined: |
Hey Lindum. Thanks for the program, it detected a "worm sdbot.gen virus"
and deleted it. However, the system still shuts down and the problem seems to still be here. But thanks for the attachment anyhows. Ho hum
|
|
|
Do Nothing Button
Copyright 2001-2023 by EvC Forum, All Rights Reserved
Version 4.2
Innovative software from Qwixotic © 2024