Oh God, Please Help...

I'm going craZy...

I just installed windows XP Pro and I love it - I had to re-install a bunch of progs after the update, and have had no problems. Well, one problem... ONE BIG PROBLEM. I can't install my Norton Antivirus Software...

The Norton Utilities software (the disk check and Windows check) work fine, but the Virus Scanning will not install... During the install it keeps "rolling back." I think it has something to do with the security setting on my PC. It won't allow the antivirus prog to install...

Also, I am getting this message frequently:

LSA Shell (Export Version) has encountered a problem and needs to close. We are sorry for the inconvenience.

---

Please help me... NT AUTHORITY\SYSTEM keeps shutting me down.

Thanks.

 

Log in or Sign up to hide all adverts.

More info:

The shutdown screen is also telling me that there is a problem with thies file:

lsass.exe

It keeps suddenly unexpectedly terminating. And forces my PC to shut down. I get about 3 minutes... then have to re-boot. Oh, here it goes..

Goodbye

Message:

The system process
C:\WINDOWS\System32\lsass.exe
terminated with qith status code -1073741989

HELP

 

Log in or Sign up to hide all adverts.

Congratulations, you've been wormed. This is the classic symptom of the Sasser virus.

There is a <a href="http://www.sciforums.com/showthread.php?t=35861">thread</a> where it was discussed before. At the bottom, I posted a couple of different methods of dealing with it. The last one is a fix that removes the vulnerability.

Next, make sure you stay up to date on critical patches from windows updates.

edit: Does it look something like this?

Please Register or Log in to view the hidden image!

or

Please Register or Log in to view the hidden image!

 

Log in or Sign up to hide all adverts.

EXACTLY - please tell me how to fix

 

First, turn on the Windows XP firewall (until you get a real one like Sygate).
Next time it happens, go to Start > Run, and type shutdown -a
Go to www.grisoft.com and get the free version of AVG, update it, and do a full scan.

 

Check out the link I posted above, there are a few choices. I think stinger will remove it. Once you get the proper critical update, the vulnerability will be fixed. You'll still need to remove the worm though. Welcome to the wonderful world of Microsoft.

Please Register or Log in to view the hidden image!

 

Oh, and go to http://windowsupdate.microsoft.com/ ASAP.

 

My computer is running fine, I think... I'm still getting a strange BEEP at Windows start... How can I be positive the worm is gone? After running Stinger, it did not tell me anything - in report - but I ran it a second time and two of my files were clean...

I want to be sure.

 

Anti-virus. You'll be fine once you're updated.

 

Now I am FIXED... thank you all...

But, My PC wn't shut down.... I have to hit the power botton on my surge protector. What the Hell.

 

I think it might have had something to do with the shutdown -a that Alpha had you do. Hmm, maybe not, I just checked it out and all it does is abort a shutdown. Will it shut down normally now? Try shutdown -s or shutdown -r. s shuts it down, r restarts it. I don't know, it's a new one on me. Never seen a computer that wouldn't shut down.

 

I strongly recommend formatting in these cases. Try slipstreaming an antivirus into your Windows install disk for safety.

 

I tried formatting and it wouldn't let me... said the drive was in use

 

Just save an install of the antivirus on another partition or on another disk. Don't connect to the net til you have it installed. Or better yet, before you log on to the net turn on your windows firewall. It's crap, but I'm relatively sure that they say it blocks sasser, then go straight to windows update and update. If you're on broadband, get a router firewall. You save yourself so much headache that way.

And speaking of windows update, when the hell is service pack 2 comin? Cmon Microsoft. Whip it out...

 

Really, now that is odd. How did you try to format? If you're going to be formatting anyway (just installed XP, no emotional attachment yet?) just put the disk in the drive and boot from it. You should be able to format no problem. The only thing that would mess with you during an install like this would be bios viruses, which are rare.


Edit: and formatting and starting from scratch would be what I would do as well. I have no desire to risk having anything on my computer. I reinstall monthly anyway, I'm protesting Microsoft's authentication procedure. I used to install every few months, but monthly isn't too bad. Just a couple of hours a month.

 

Some of us have XP Corp...

Please Register or Log in to view the hidden image!

Try using Partition Magic. Works wonders. If you have a CD Burner and a working internet connection, I can show you how to slipstream SP1 to further protect your system.

 

What do you mean slipstream? I've got partition magic and drive image. I've tried to make a drive image of a freshly installed installation with all updates, but it saves the authentication date, so when I reinstall, the month is already over. Bastards...

I've got SP1 backed up so I don't have to download it all the time, still got to go on and get the rest of them though. Using XP Pro by the way. What's the difference with Corp? Site license so you don't have to authenticate?

 

Slipstream simply means adding SP1 to your Windows CD so when you install Windows from the CD, SP1 is automatically installed so that you dont have to manually add it later on.

Using the above method, all my Windows installations automatically come with DirectX 9.0b and SP1, along as Windows Media Player 9 and other goodies for the computer.

Here's an excellent site which got me going. Definitely recommend:
http://unattended.msfn.org/


With XP Corp, you can install on multiple PC's with the same serial, absolutely no activation needed.

Thank goodness I had the good sense to buy it.

Please Register or Log in to view the hidden image!

 

Crap, I don't want to FORMAT the whole drive because of this SHUTDOWN problem. I fixed the virus, there must be a way to fix this... Ugh...

 

That will be SYSTEMS RESTORE, it's a function of XP to attempt to create a method of reverting back (ROLL BACK) incase somebody alters files in your system, however the problem with the process is it tends to take copies of viruses and houses them in a way that you can't delete them without following specific instructions:

http://support.microsoft.com/defaul...port/kb/articles/Q263/4/55.ASP&NoWebContent=1

This should point to an article on how to deal with the systems _RESTORE, it's written by Microsoft and allows you to use the _RESTORE function after "Purging".
(Personally I tend to turn it off completely since it causes more trouble than it fixes, instructions how are mentioned under the "Manual" section of that link.)

Another thing you might be interested in is that if you have the power option of "Hibernate", your system can reserve the same amount of space on your drive as you have RAM for if your system goes into a Hibernated state. (basically when the computer hibernates it copies the contents of RAM to drive, so when it wakes up it reverses the process)

If you want to save harddrive space and you don't need the hibernate feature, then I suggest going to your Control Panel, then selecting "Power Options", click the "Hibernate" tab and uncheck the "Enable Hibernation" box.

This will mean your system won't hibernate or chew up your harddrive space. (It's noticable if you have Gb's of RAM)