What is this? Degrades system performance, shut downs, error message

Question

I thought I had a Sasser Worm, but apparently that's not what it is. My virus scan isn't picking it up, so can someone guess as to what it is so I can download a removal tool?   The system keeps randomly shutting down. Sometimes it will go for days even weeks without doing this. Other times, it will shut down one or just a few times during the day and work perfectly great after restart. Sometimes, it will shut down and continue to do after each restart. Sometimes it won't even get to the desktop.   Sometimes, when you start it up after a shutdown, before it gets to the desktop it gives you this error: Operation was unsuccessful (0xc0000....) At the top of this error message, it says lsass.exe Then will immediately shut off.   This virus is not only causing the shutdown problem but seems to be causing system degradating (making things run slowly and giving me memory errors).   My virus definitions are updated. I've tried the removal tool for TrojanVundo, the W32.Sasser worm, and GaBot. It said that none of these were found. The system usually shuts down before I can run a complete scan with Norton.   When I press Ctrl+Alt+Delete, a whole lot of processes are running including about 4 or 5 of svchost.exe - not sure if that is normal?   I'm pretty good about not dowloading unknown attachements, and I started noticing problems after being on the internet...maybe a popup ad?   I guess I should also add that it shuts off when running in safe mode as well.   Any ideas?   Oh, and I'm not on that computer now...mine won't stay on long enough to do a Hijackthis right now. Message Edited by jersey8 on 11-24-2005 02:17 PM

jersey8 · Answer

? I'm not sure if you were serious or what, but I know it is not a hardware problem. And I've already called the people at Dell, 3 times.   Does anyone have any ideas? I need to do work on this computer, and I need to try and get it resolved as soon as possible. Message Edited by jersey8 on 11-24-2005 10:53 PM

ky331 · Answer

if it's a software (virus/spyware) problem, we may be able to locate it using HiJackThis.

EDIT: I re-read, where you say the machine won't stay on even long enough to generate your log :smileymad: (but since i've already included this...)

Have you tried to download and run the Microsoft Malicious Software removal tool?

http://www.microsoft.com/downloads/details.aspx?familyid=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Preliminary note: When attempting the following directions, if you can't access the internet or perform the indicated download of HiJackThis (HJT) on your "infected" machine, you should download it onto another "good" machine (one at work?), then transfer it via floppy (it's a tiny file) to the infected machine, run the UNZipped/.EXE file on the infected machine, and finally transfer the generated log via floppy over to the good machine, to post your log online.

Download the latest version of HJT(hijackthis) (version 1.99.1) from

http://majorgeeks.com/download3155.html

you must create a separate folder and place it there.... people commonly use C:\HJT. Note: Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.

The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer. If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )

After Unzipping, double click on HiJackThis.EXE

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.

Hopefully, one of the HJT experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.

Supplemental note: The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people. Nevertheless, it seems that many individuals try to be "creative", and make some variations. It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.

Specifically, the following are 3 very common BAD deviations which will cause delays:

a) BAD: using an older/outdated version of HiJackThis...

The experts only work with the current version. So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log.

b) BAD: using a TEMP directory or your DESKTOP for HJT....

Some experts may insist you move HJT before they'll begin working with you. Others will start the repair process, advising you to move HJT as one of the very first steps. Failure to do so can result in losing potentially critical information. So please, just use the suggested C:\HJT directory, rather than try to be creative.

c) BAD: posting your log in the wrong forum...

if you post your log back here, in the Virus/SpyWare forum, it will "sit idly", either until the forum moderator gets around to move it for you... or until you decide to repost your log... in the HiJackThis forum.

POST SCRIPT: It has come to my attention that many people are unfamiliar with how to create the recommended sub-directory/folder C:\HJT ;

while others are able to create this directory, but are unsure how to move HJT into it (from wherever it happened to get downloaded into, "by default")...

If you have either of these "problems", then you should d ownload a self-extracting copy of HijackThis from

http://downloads.malwareremoval.com/hijackthis_sfx.exe

Save it to your Desktop.

Double-click on the file hijackthis_sfx.exe file, and it will self-extract into its own folder,

C:\Program Files\HijackThis

Virus & Spyware

What is this? Degrades system performance, shut downs, error message

Was this post helpful?