LSA Shell (Export Version) error

[John J. Hughes II]

After installing the last Windows Update from the Windows Update site my
system is giving me LSA errors after logging on to each account on my
system. It asked to reboot the first time but after that it does not seem
to reboot so it's mostly just annoying.

AVG says there is no virus.

If I send the error report to MS, MS puts me on a webpage about the Sassar
<sp>. That web page says I am not infected.

So if I don't have a virus/worm, what could be the other problem?

Regards,
John

 

[Lanwench [MVP - Exchange]]

What do you see in your event logs?

 

[Kenny S]

Your system is infected by the Sasser worm which exploits the MS04-011 LSASS
Vulnerability. You can download the worm removal tool from
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

After the worm has been removed, download and install the critical update
IMMEDIATELY from
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx


--

Hope this helps. Let us know.
_____________
Kenny S
http://www.computerboom.net
FREE programs and MORE!

 

[John J. Hughes II]

There are a couple :

1) Faulting application lsass.exe, version 5.1.2600.1106, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 31 2e 32 36 30 30 2e .1.2600.
0028: 31 31 30 36 20 69 6e 20 1106 in
0030: 75 6e 6b 6e 6f 77 6e 20 unknown
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00

2) Fault bucket 22492347.

0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 32 32 34 39 32 33 34 37 22492347
0010: 0d 0a ..


"Lanwench [MVP - Exchange]"

 

[Lanwench [MVP - Exchange]]

But you aren't getting the LSASS countdown/shutdown message, right? Have you
tried running McAfee's Stinger tool just in case? Got your firewall enabled?
Run Windows Update (run early, run often!!!) ?

There are a couple :

1) Faulting application lsass.exe, version 5.1.2600.1106, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 31 2e 32 36 30 30 2e .1.2600.
0028: 31 31 30 36 20 69 6e 20 1106 in
0030: 75 6e 6b 6e 6f 77 6e 20 unknown
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00

2) Fault bucket 22492347.

0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 32 32 34 39 32 33 34 37 22492347
0010: 0d 0a ..


"Lanwench [MVP - Exchange]"

What do you see in your event logs?

 

[John J. Hughes II]

No it does not ask to reboot after the first time.

Firewall is on and has been from the day I got the computer.

I have auto update turned on and running, I also do manual checks of the
windows update set.

System was fine yesterday when I rebooted, this morning there was a icon to
update my system, you know the windows update one. I updated, it ask to
reboot, I rebooted, and problem started.

Regards,
John


"Lanwench [MVP - Exchange]"

But you aren't getting the LSASS countdown/shutdown message, right? Have you
tried running McAfee's Stinger tool just in case? Got your firewall enabled?
Run Windows Update (run early, run often!!!) ?

There are a couple :

1) Faulting application lsass.exe, version 5.1.2600.1106, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 31 2e 32 36 30 30 2e .1.2600.
0028: 31 31 30 36 20 69 6e 20 1106 in
0030: 75 6e 6b 6e 6f 77 6e 20 unknown
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00

2) Fault bucket 22492347.

0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 32 32 34 39 32 33 34 37 22492347
0010: 0d 0a ..


"Lanwench [MVP - Exchange]"

What do you see in your event logs?

John J. Hughes II wrote:
After installing the last Windows Update from the Windows Update
site my system is giving me LSA errors after logging on to each
account on my system. It asked to reboot the first time but after
that it does not seem to reboot so it's mostly just annoying.

AVG says there is no virus.

If I send the error report to MS, MS puts me on a webpage about the
Sassar <sp>. That web page says I am not infected.

So if I don't have a virus/worm, what could be the other problem?

Regards,
John

 

[John J. Hughes II]

Well I have tried three removal tools, MS website thingy, and AVG and
everything says I am clean. The problem remains everytime I log into an
account I get the error message. So I either have a brand new virus or
there is no virus.

Now assuming there is no virus, is there another way of fixing this problem?

Regards,
John

 

[John J. Hughes II]

Stinger says I am clean.

 

[John J. Hughes II]

No virus found on system by all test.

Error still exists.

Did not help.

Regards,
John

 

[Malke]

No virus found on system by all test.

Error still exists.

Did not help.

Regards,
John

If you are 100% sure that your system is clean; i.e., have run a scan in
Safe Mode with an installed, full-featured av program using updated
definitions, then do a Repair Install. Instructions are here:

http://www.michaelstevenstech.com/XPrepairinstall.htm

Good luck,

Malke

 

[John J. Hughes II]

One of the services I have installed on my system opens a port on the
network. If I disable the service the problem goes away. Something in the
last MS update caused this problem, now I just have to figure out how to fix
it. Or I guess I could ignore it, it only happens when I log on and I don't
do that very often.

Regards,
John

 

[Malke]

One of the services I have installed on my system opens a port on the
network. If I disable the service the problem goes away. Something
in the last MS update caused this problem, now I just have to figure
out how to fix
it. Or I guess I could ignore it, it only happens when I log on and I
don't do that very often.

Are you sure it was Microsoft and not spyware? One of the latest
CoolWebSearch variants creates a service called Network Security
Service.

Malke

 

[John J. Hughes II]

Well the Service I am shutting down is not from MS at all. The service is
from another company which I installed and is signed and trusted. Updating
MS caused the problem to start and in concept should not have anything to do
with the Service at all. Turning the Service off just stopps the error
message.

Regards,
John

 

[Steffen Maurer]

Well the Service I am shutting down is not from MS at all. The service is

from another company which I installed and is signed and trusted.
Updating
MS caused the problem to start and in concept should not have anything to
do
with the Service at all. Turning the Service off just stopps the error
message.

What is the name of the service and from which software is it? I get the
same problem but I definitively have no sasser ...


Regards, Steffen