Understanding through Discussion


Welcome! You are not logged in. [ Login ]
EvC Forum active members: 71 (9014 total)
48 online now:
kjsimons, PaulK, Tangle (3 members, 45 visitors)
Newest Member: Ashles
Post Volume: Total: 882,097 Year: 13,845/23,288 Month: 37/326 Week: 57/92 Day: 7/3 Hour: 0/0


Thread  Details

Email This Thread
Newer Topic | Older Topic
  
Author Topic:   HELP
mike the wiz
Member
Posts: 4697
From: u.k
Joined: 05-24-2003


Message 1 of 35 (121849)
07-04-2004 2:34 PM


Hi there.

My computer/net has goosed. So...., I desire a computer expert to determine my future existence at this site. Apparently, Queen Asgara is a computer wiz, hence - I command her input. Now, I have 3 minutes on the web before the system shuts down. I have tried for a week to fix it despite my none-skills at pcing. "system shutting down" to restart, and then it counts a minute and restarts. This gives no options for the restart, and nothing stops the process. Well, what can I say, I've had to type this message in notepad cos I've only got three minutes to log in and make this topic... I hope someone knows about pc problems. Also, I will only be able to return to this site and read your message for.....3 minutes. SO, this might be fun afterall, but I'm a slow reader and it's a bummer if no one has a clue just like me.

I mean, I've reinstalled windows, and the web logs on just fine, and I can even go from site to site, yet the activation of the web seems to cause this problem which always happens within 3 minutes of surfing. So,... I'm stumped. Anyone ever heard of "lsa shell export"? This seems to pop up and asks "send error report"?? and when I press "don't send" this "shutting down" thing happens, whether I ignore the "lsa shell" thing or not, the shutting down process will happen about half a minute later. Yet no explanation is given????? Grrrrr. Can such a system shut down be stopped in any way?. Yes, I've tried alt+ctrl+delete.

Please don't ask me any questions - just solve my problem you useless goons as it will take me 3 minutes to read your post probably, that's if anyone reads this lame topic.

PS. Can someone please bump this topic for me, when it is gone from the "list all topics". Thanks.
.., and keep your baba good.

Oh well, put me in the Holmes section cos it looks like I'm gonna be gone for a loooooong time.
I blame Asgara. And Lam aswell, Cos he called me a hybrid, and there's a conspiracy to rid me from the evc..


Replies to this message:
 Message 2 by jar, posted 07-04-2004 2:37 PM mike the wiz has not yet responded
 Message 3 by Lindum, posted 07-04-2004 2:57 PM mike the wiz has not yet responded
 Message 4 by NosyNed, posted 07-04-2004 2:58 PM mike the wiz has not yet responded
 Message 5 by Melchior, posted 07-04-2004 3:18 PM mike the wiz has not yet responded
 Message 10 by Trixie, posted 07-04-2004 3:36 PM mike the wiz has not yet responded

  
jar
Member
Posts: 33024
From: Texas!!
Joined: 04-20-2004
Member Rating: 3.1


Message 2 of 35 (121851)
07-04-2004 2:37 PM
Reply to: Message 1 by mike the wiz
07-04-2004 2:34 PM


You have sinned and are being punished for disparaging the Holy Name of Asgara.

You have one of the viruses. Start up in safe mode and run your anti-virus software.


Aslan is not a Tame Lion

This message is a reply to:
 Message 1 by mike the wiz, posted 07-04-2004 2:34 PM mike the wiz has not yet responded

  
Lindum
Member (Idle past 2096 days)
Posts: 162
From: Colonia Lindensium
Joined: 02-29-2004


Message 3 of 35 (121854)
07-04-2004 2:57 PM
Reply to: Message 1 by mike the wiz
07-04-2004 2:34 PM


Sounds like sasser... try this link and download the microsoft fix - it's only small so you should have time!

This message is a reply to:
 Message 1 by mike the wiz, posted 07-04-2004 2:34 PM mike the wiz has not yet responded

  
NosyNed
Member
Posts: 8951
From: Canada
Joined: 04-04-2003


Message 4 of 35 (121855)
07-04-2004 2:58 PM
Reply to: Message 1 by mike the wiz
07-04-2004 2:34 PM


oh oh
It sounds like you have the blaster worm.

You might be able to keep things up long enough to get it out of there if you reboot in VGA mode. For some reason that worked on my Dads PC. If not it gets harder.

If you google "blaster worm" you should find lots of places to help.

www.microsoft.com has information on it.

If you can post the exact message you're getting then we might be able to confirm the blaster


This message is a reply to:
 Message 1 by mike the wiz, posted 07-04-2004 2:34 PM mike the wiz has not yet responded

  
Melchior
Inactive Member


Message 5 of 35 (121858)
07-04-2004 3:18 PM
Reply to: Message 1 by mike the wiz
07-04-2004 2:34 PM


Since it only happens when you go online, it does indeed seem like one of the worms that uses security holes in WinXP/2k to crash certain critical programs.

If you are using Windows XP, I suggest you try one thing first.

Go to start->settings->network connections->Local area network (or similar)->advanced->enable firewall->OK.

If the problems stops after this, you can easily download the security updates for Windows to remove the problem fully.

Always run checks on your computer afterward.

This message has been edited by Melchior, 07-04-2004 02:19 PM


This message is a reply to:
 Message 1 by mike the wiz, posted 07-04-2004 2:34 PM mike the wiz has not yet responded

Replies to this message:
 Message 7 by NosyNed, posted 07-04-2004 3:20 PM Melchior has responded

  
Brad
Member (Idle past 3487 days)
Posts: 143
From: Portland OR, USA
Joined: 01-26-2004


Message 6 of 35 (121859)
07-04-2004 3:19 PM


Or, when you first get on, go download zonealarm, after that program is installed it asks you if you want to allow programs internet access, for some reason the blaster worm requires internet access, so if you don't allow access to anything that you don't know what it is then you should be able to restrict blaster's access long enough to get a patch. Also this makes it less stressful to get a patch for it. At least that's what I did. Hope it helps.
-Brad

  
NosyNed
Member
Posts: 8951
From: Canada
Joined: 04-04-2003


Message 7 of 35 (121860)
07-04-2004 3:20 PM
Reply to: Message 5 by Melchior
07-04-2004 3:18 PM


firewall
The firewall should stop the blaster from getting in. But I didn't think it would affect it once it is in there.

This message is a reply to:
 Message 5 by Melchior, posted 07-04-2004 3:18 PM Melchior has responded

Replies to this message:
 Message 8 by Melchior, posted 07-04-2004 3:28 PM NosyNed has not yet responded

  
Melchior
Inactive Member


Message 8 of 35 (121864)
07-04-2004 3:28 PM
Reply to: Message 7 by NosyNed
07-04-2004 3:20 PM


Re: firewall
There are some non-worms that regularily uses certain exploits in the OS. The only thing they do is crash your computer, but don't actually infect it. I had a lot of problems with that some time ago.

It could be a worm, in which case he should be able to detect it via anti-virus or anti-spyware programs.

The thing is, computers infected with most Blaster variants (especially the ones first developed) show very well that they are messed up. They start running very very slow, and messes up connection to things such as IRC and such.

If the computer works perfectly fine up until the shutdown, I think it's something else.


This message is a reply to:
 Message 7 by NosyNed, posted 07-04-2004 3:20 PM NosyNed has not yet responded

Replies to this message:
 Message 9 by Melchior, posted 07-04-2004 3:32 PM Melchior has not yet responded

  
Melchior
Inactive Member


Message 9 of 35 (121865)
07-04-2004 3:32 PM
Reply to: Message 8 by Melchior
07-04-2004 3:28 PM


Re: firewall
Btw, since it seems to target lsass, it probably is Sasser as Lindum figured, which can both act as a normal worm and infect the computer, or if that's not directly possible, still crash a computer whenever it's online.

Still, all variants can be fixed by first firewalling the computer to prevent shutdowns, then download and run the various fixes/searches.

This message has been edited by Melchior, 07-04-2004 02:34 PM


This message is a reply to:
 Message 8 by Melchior, posted 07-04-2004 3:28 PM Melchior has not yet responded

  
Trixie
Member (Idle past 2405 days)
Posts: 1011
From: Edinburgh
Joined: 01-03-2004


Message 10 of 35 (121867)
07-04-2004 3:36 PM
Reply to: Message 1 by mike the wiz
07-04-2004 2:34 PM


FixBlast sent by e-mail
Mike, your puter is doing exactly what the Blaster-infected ones did - I cleaned loads of those machines, mainly because I didn't get it so I was able to download the fix and put it on floppies for people. I've sent you an e-mail with the fix tool attached. Unfortunately its got a .exe extension, so if you use Outlook to download your e-mail it may get refused. If that happens let me know and I'll try changing the file extension to something nonsensical and send it again. Good luck. By the way, get ZoneAlarm as soon as you can get online long enough. Its free to download the personal version and so are the updates, its a really good firewall, works a dream. I think that's why I didn't get blaster in the first place.

This message is a reply to:
 Message 1 by mike the wiz, posted 07-04-2004 2:34 PM mike the wiz has not yet responded

Replies to this message:
 Message 12 by Melchior, posted 07-04-2004 3:39 PM Trixie has not yet responded

  
jar
Member
Posts: 33024
From: Texas!!
Joined: 04-20-2004
Member Rating: 3.1


Message 11 of 35 (121868)
07-04-2004 3:36 PM


One other thing to check.

If you are running windows 2000 there is a well known problem that will give you exactly those symptoms.

See this link


Aslan is not a Tame Lion

  
Melchior
Inactive Member


Message 12 of 35 (121869)
07-04-2004 3:39 PM
Reply to: Message 10 by Trixie
07-04-2004 3:36 PM


Re: FixBlast sent by e-mail
Mmm, Zone Alarm will automatically block all those exploits. The only problem is that the free version is just a 30 day trial version, and it does take quite a bit of resources compared to a hardware firewall.

Definitely better than leaving your computer wide open, though, and relatively easy to setup even if you haven't used a firewall before.


This message is a reply to:
 Message 10 by Trixie, posted 07-04-2004 3:36 PM Trixie has not yet responded

  
mike the wiz
Member
Posts: 4697
From: u.k
Joined: 05-24-2003


Message 13 of 35 (121871)
07-04-2004 3:57 PM


Guys, here's the 2 messages. The first says;

"LSA export version has encountered a problem and needs to close"

Then, whether I press "don't send" or just ignore it, it then displays this message;

"This system is shutting down. Please save all work in progress....This shutdown was initiated by NT AUTHORITY\SYSTEM.....The system process was system 32\lsass.exe."

Now to me, that might aswell be written in Japenese with my pc skill - lack thereof.

Thanks so far guys. I have read your messages and am reading about two messages per webtime. I have tried the firewall to no evail. I have downloaded the small anti-virus package and it says "detected no virus", and I have rebooted in VGA mode. None have worked unfortunately, but I am grateful for all suggestions, and will most desperately try anything. Although it is getting very difficult to read now as it seems to be getting less time. I have about a minute and a half now. Did Trixie say she emailed me? (I am writing this post in notepad) My new email is Thewispo2004@yahoo.co.uk. I am sorry if you sent to my old email. I will check my new email address, and hope I can get to the email in time, but for now, this is just so difficult to read this topic. It's shutdown about ten times already. Thanks to everyone, I will try all suggestions, but do remember I am a pc twit.


Replies to this message:
 Message 14 by Lindum, posted 07-04-2004 4:25 PM mike the wiz has responded

  
Lindum
Member (Idle past 2096 days)
Posts: 162
From: Colonia Lindensium
Joined: 02-29-2004


Message 14 of 35 (121875)
07-04-2004 4:25 PM
Reply to: Message 13 by mike the wiz
07-04-2004 3:57 PM


Mike, I've emailed you the latest version of Stinger from Mcaffee anti-virus - it will hopefully fix the problem. Just make sure you don't go online when you run it! If the email doesn't work you can get the program here: http://vil.nai.com/vil/stinger/

This message is a reply to:
 Message 13 by mike the wiz, posted 07-04-2004 3:57 PM mike the wiz has responded

Replies to this message:
 Message 15 by mike the wiz, posted 07-04-2004 4:49 PM Lindum has responded

  
mike the wiz
Member
Posts: 4697
From: u.k
Joined: 05-24-2003


Message 15 of 35 (121876)
07-04-2004 4:49 PM
Reply to: Message 14 by Lindum
07-04-2004 4:25 PM


Hey Lindum. Thanks for the program, it detected a "worm sdbot.gen virus"
and deleted it. However, the system still shuts down and the problem seems to still be here. But thanks for the attachment anyhows. Ho hum

This message is a reply to:
 Message 14 by Lindum, posted 07-04-2004 4:25 PM Lindum has responded

Replies to this message:
 Message 16 by Lindum, posted 07-04-2004 5:01 PM mike the wiz has responded

  
Newer Topic | Older Topic
Jump to:


Copyright 2001-2018 by EvC Forum, All Rights Reserved

™ Version 4.0 Beta
Innovative software from Qwixotic © 2020