ie shutdown error in lsass.exe

alias2700 · 05-02-2005, 04:31 AM

i recently had to use a dial-up connection because my dsl was down, when i experienced automatic shutdown when i opened my ie (at yahoo mail homepage) after a few minutes of logging in. it said there was an error in lsass.exe shell extension. what was that about? my virus scanner and spysweeper scan didn't show any viruses. help please. i'm new at this forum. thanks.

**jgvernonco** · 05-02-2005, 06:38 AM

Sasser will do that, as well as one varient of My Doom. Of course, a corrupted file can do it, too.

Am I decisive, or what?

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro-europe.com/ente...all_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. You may use Panda ActiveScan also at http://www.pandasoftware.com/products/activescan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Many times, the on-line scans will pick up something that the resident scanners do not, because of masking.

Let us know if the scan(s) find anything.

alias2700 · 05-05-2005, 12:34 AM

i have just finished scanning online using the pandasoftware link you gave. report said there are several spyware and adware in my computer but it cannot be disinfected by the active scan. i was asked togo ta certain link again to find solutions, but it was their online store recommending that i buy the products for antivirus. is there any other way to remove these spyware? it seems my spysweeper cannot detect it. here is a copy of the full report from the active scan. i hope you can help me further. thanks.

Incident Status Location

Spyware:Spyware/ISTbar No disinfected C:\Program Files\ISTsvc\istsvc.exe
Spyware:Spyware/ISTbar No disinfected C:\PROGRA~1\ISTsvc\istsvc.exe
Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Betting.lnk
Adware:Adware/Apropos No disinfected C:\DOCUME~1\Joy\LOCALS~1\Temp\cfout.txt
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Betting.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Casino Palace.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Casino.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Games.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Horoscope.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Air Tickets.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Car Rentals.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Hotel Deals.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Luggage.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Travel.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Find a Degree.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Find a job.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Home.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Insurance.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Auctions.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Books.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Computers.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Discount.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Flowers.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Golf.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Jewelry.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Movies.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Music.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Online Store.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Perfume.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Sleepwear.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\Adware Remover.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\Anti-Virus.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\PC Cleaner.lnk
Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\Tech & gadgets.lnk
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Joy\Local Settings\Temp\GcxJbX.exe
Spyware:Spyware/YourSiteBar No disinfected C:\Documents and Settings\Joy\Local Settings\Temp\iinstall21244.exe
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Joy\Local Settings\Temp\istsv_.exe
Spyware:Spyware/ISTbar No disinfected C:\Program Files\ISTsvc\istsvc.exe

**ReeKorl** · 05-05-2005, 05:05 AM

Download, install, update, customise and run Ad-Aware SE Personal Edition.

Hopefully this will clear up those other entries. Failing that, head on over to our Hijack This Help section and read this post before posting a log.

alias2700 · 05-08-2005, 10:03 PM

i have already scanned using adaware and it has removed the other malware but the istsvc.exe file cannot be removed. the log said that it's being used by other programs. i don't know what program is using that file. but i saw that it was under my intervideo program file. i already uninstalled this program but the istsvc still cannot be removed. i haven't used the hijack log you were suggesting.help please.

**Terrister** · 05-09-2005, 06:43 AM

In most cases if Ad-aware can not remove a file it will ask you if it can run after rebooting before the desktop loads. It is able to remove things here it can not remove once Windows has started. If it did not ask you this, you might want to try Spybot or Microsoft Anti-spyware. If this does not work, run a hijack this log and post it.

05-02-2005, 04:31 AM	#1 (permalink)
alias2700 Registered User Join Date: May 2005 Posts: 9 OS: XP	ie shutdown error in lsass.exe i recently had to use a dial-up connection because my dsl was down, when i experienced automatic shutdown when i opened my ie (at yahoo mail homepage) after a few minutes of logging in. it said there was an error in lsass.exe shell extension. what was that about? my virus scanner and spysweeper scan didn't show any viruses. help please. i'm new at this forum. thanks.

05-02-2005, 06:38 AM	#2 (permalink)
jgvernonco Old Timer Join Date: Sep 2003 Location: Northern Arizona Posts: 7,958 OS: Vista Home Premium, SP 27	Sasser will do that, as well as one varient of My Doom. Of course, a corrupted file can do it, too. Am I decisive, or what? If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro-europe.com/ente...all_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. You may use Panda ActiveScan also at http://www.pandasoftware.com/products/activescan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan. Many times, the on-line scans will pick up something that the resident scanners do not, because of masking. Let us know if the scan(s) find anything. __________________ Donations keep TSF moving forward. Please help. http://www.myspace.com/speedbumpthecelt

05-05-2005, 12:34 AM	#3 (permalink)
alias2700 Registered User Join Date: May 2005 Posts: 9 OS: XP	scanned with pandasoftware i have just finished scanning online using the pandasoftware link you gave. report said there are several spyware and adware in my computer but it cannot be disinfected by the active scan. i was asked togo ta certain link again to find solutions, but it was their online store recommending that i buy the products for antivirus. is there any other way to remove these spyware? it seems my spysweeper cannot detect it. here is a copy of the full report from the active scan. i hope you can help me further. thanks. Incident Status Location Spyware:Spyware/ISTbar No disinfected C:\Program Files\ISTsvc\istsvc.exe Spyware:Spyware/ISTbar No disinfected C:\PROGRA~1\ISTsvc\istsvc.exe Adware:Adware/SaveNow No disinfected Windows Registry Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Betting.lnk Adware:Adware/Apropos No disinfected C:\DOCUME~1\Joy\LOCALS~1\Temp\cfout.txt Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Betting.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Casino Palace.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Casino.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Games.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Fun & Games\Horoscope.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Air Tickets.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Car Rentals.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Hotel Deals.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Luggage.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Going Places\Travel.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Find a Degree.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Find a job.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Home.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Living\Insurance.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Auctions.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Books.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Computers.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Discount.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Flowers.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Golf.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Jewelry.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Movies.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Music.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Online Store.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Perfume.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Shop\Sleepwear.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\Adware Remover.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\Anti-Virus.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\PC Cleaner.lnk Adware:Adware/CWS No disinfected C:\Documents and Settings\Joy\Favorites\Technology\Tech & gadgets.lnk Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Joy\Local Settings\Temp\GcxJbX.exe Spyware:Spyware/YourSiteBar No disinfected C:\Documents and Settings\Joy\Local Settings\Temp\iinstall21244.exe Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Joy\Local Settings\Temp\istsv_.exe Spyware:Spyware/ISTbar No disinfected C:\Program Files\ISTsvc\istsvc.exe

05-05-2005, 05:05 AM	#4 (permalink)
ReeKorl Superhuman Computer Join Date: Mar 2005 Location: 6th Circle, The City of Dis, Hell Posts: 1,610 OS: WinXP Pro SP2 My System	Download, install, update, customise and run Ad-Aware SE Personal Edition. Hopefully this will clear up those other entries. Failing that, head on over to our Hijack This Help section and read this post before posting a log. __________________ "Sorry, the number you have dialled is imaginary. Please rotate dial by 90 degrees and try again."

05-08-2005, 10:03 PM	#5 (permalink)
alias2700 Registered User Join Date: May 2005 Posts: 9 OS: XP	istsvc.exe remains i have already scanned using adaware and it has removed the other malware but the istsvc.exe file cannot be removed. the log said that it's being used by other programs. i don't know what program is using that file. but i saw that it was under my intervideo program file. i already uninstalled this program but the istsvc still cannot be removed. i haven't used the hijack log you were suggesting.help please.

05-09-2005, 06:43 AM	#6 (permalink)
Terrister Moderator Hardware Forum Join Date: Apr 2005 Location: West Georgia, USA Posts: 7,098 OS: Xp	In most cases if Ad-aware can not remove a file it will ask you if it can run after rebooting before the desktop loads. It is able to remove things here it can not remove once Windows has started. If it did not ask you this, you might want to try Spybot or Microsoft Anti-spyware. If this does not work, run a hijack this log and post it.