Author Topic: winxp shutdown in 30 seconds  (Read 8753 times)

0 Members and 1 Guest are viewing this topic.

tuuleveski

  • Guest
winxp shutdown in 30 seconds
« on: April 02, 2009, 11:12:40 PM »
i got this shutdown message (that sasser worm like thing) a while ago and again today. so i decided to take the hard disk out of this pc and scan it with another pc that has avast! Home Edition, but it didn't find that sasser worm. so do i really have the worm or these forced shutdowns can just happen without having that virus?

CharleyO

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #1 on: April 03, 2009, 07:45:51 AM »
***

Welcome to the forums,  tuuleveski.   :)

Can you give us the exact words used in the message?

Also, can you do an avast boot time scan of that hard drive?


***

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: winxp shutdown in 30 seconds
« Reply #2 on: April 03, 2009, 08:56:30 AM »
Try scanning with an online scanner like Kaspersky.
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: winxp shutdown in 30 seconds
« Reply #3 on: April 03, 2009, 02:56:04 PM »
I suggest a full computer on-line scanning:
BitDefender
ESET NOD32
F-Secure

For detection-only, not cleaning:
Kaspersky
Trendmicro housecall
The best things in life are free.

tuuleveski

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #4 on: April 04, 2009, 02:10:44 AM »
I don't exactly remember the message, but it had something to do with lsass.exe. I did boot time scan, but it returned nothing. I also did an online NOD32 scan when running the OS from that drive and also F-Secure online scan in another computer, both didn't find any virus.

What kind of utility can I use to monitor all the processes that could help me determine if there is a virus?

And is that autoshutdown always connected to sasser worm or can it be something else not related to any virus?

mojako_2you

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #5 on: April 05, 2009, 11:22:43 AM »
your computer maybe not infected by any virus. Just maybe some of your windows component are not work. in this case maybe the user account component are not working. Any windows popup say that your lsass.exe component error then telling you that the computer will be shutdown or else???

tuuleveski

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #6 on: April 05, 2009, 03:06:24 PM »
yes, a windows pop up or msgbox, similar to this one:

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: winxp shutdown in 30 seconds
« Reply #7 on: April 05, 2009, 03:43:40 PM »
Read the instructions, download and burn (maybe from another computer), finally use one of this rescue CD's:
1. Avira
2. Kaspersky
3. BitDefender
4. F-Secure
5. Dr. Web

Also, run
chkdsk /R
to see if it is any system file error.
The best things in life are free.

Need_O2

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #8 on: April 06, 2009, 02:07:06 PM »
open cmd and type shutdown -a
that closes the box
and check your startup apps and there should be something like shutdown -s and disable it
oh wait...
it says its because lsass.exe is terminated... hold on
http://support.microsoft.com/kb/321024 article by microsoft
it says:
   1. Click Start, and then click Run.
   2. In the Open box, type regedit, and then click OK.
   3. In Registry Editor, navigate to the following subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2
   4. Right-click Winsock2, and then click Delete on the shortcut menu that appears.
   5. Click Yes to confirm the deletion of the key.
   6. Repeat steps 3 through 5 to remove the following registry subkeys (if present):
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock2
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Winsock2
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Winsock2
   7. Quit Registry Editor.
   8. Restart Windows normally.
« Last Edit: April 06, 2009, 02:10:38 PM by Need_O2 »

tuuleveski

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #9 on: April 12, 2009, 07:53:14 PM »
it says its because lsass.exe is terminated... hold on
http://support.microsoft.com/kb/321024 article by microsoft
I'm not really sure if the error code was exactly that. This image was something I found from the web. It looks very same, but i'm not 100% sure if the code was the same.

Anyways I burned the F-Secure rescue CD, scanned the hard drive with another PC and found nothing. I did chkdsk /r - did not find any bad sectors, but the report said this:

CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
Windows has made corrections to the file system.

apart from that everything else was normal.

So this lsass.exe error might just be something other than virus?

mojako_2you

  • Guest
Re: winxp shutdown in 30 seconds
« Reply #10 on: April 14, 2009, 01:15:40 PM »
This problem occur if you have modified any of your program before. To repaired it, just insert the xp cd and repaired your window using the xp installation. Currently, this problem occur if you are using old windows version like windows SP1 or SP2 build without windows update. In my experience, there are no slightly virus that can do this problem which such a sign and symptom like this.

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: winxp shutdown in 30 seconds
« Reply #11 on: April 14, 2009, 11:22:42 PM »
it says its because lsass.exe is terminated... hold on
http://support.microsoft.com/kb/321024 article by microsoft
I'm not really sure if the error code was exactly that. This image was something I found from the web. It looks very same, but i'm not 100% sure if the code was the same.

Anyways I burned the F-Secure rescue CD, scanned the hard drive with another PC and found nothing. I did chkdsk /r - did not find any bad sectors, but the report said this:

CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
Windows has made corrections to the file system.

apart from that everything else was normal.

So this lsass.exe error might just be something other than virus?


Lots of virus scanners don't detect shutdown commands...
You might have something in your startup.
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."