Nasty Little Worm....I think :(

[Mister_DJ]

I'm having a spot of trouble with my pc these last few days.

Randomly I get an error message stating a process has encountered a problem and needs to close. Its usually LSA Shell (although I do get others) and then usually followed with a "pc has encountered a fatal error blah blah blah" and will shut down in 60 secs. Then the thing reboots.

I'm pretty sure its a worm, although I can;t fathom which one as I've tried everything to locate the bugger. Avast has done a full virus scan and found nothing. Spybot also nothing, Service Mechanic - nowt. Microsoft Malicious Do da - nada. Even Stinger drew a blank.

I'm at a total loss, but it keeps happening loads. Somethings attached itself somewhere .

Everything important I have backed up anyways, so my next plan was to reformat the hard drive and start again.

Anyone any last gasp tips they could throw my way at all please???? - Tearing what little hair I have on my head out here

Cheers.

Mart

[seandelier]

Originally Posted by Mister_DJ

I'm having a spot of trouble with my pc these last few days.

Randomly I get an error message stating a process has encountered a problem and needs to close. Its usually LSA Shell (although I do get others) and then usually followed with a "pc has encountered a fatal error blah blah blah" and will shut down in 60 secs. Then the thing reboots.

I'm pretty sure its a worm, although I can;t fathom which one as I've tried everything to locate the bugger. Avast has done a full virus scan and found nothing. Spybot also nothing, Service Mechanic - nowt. Microsoft Malicious Do da - nada. Even Stinger drew a blank.

I'm at a total loss, but it keeps happening loads. Somethings attached itself somewhere .

Everything important I have backed up anyways, so my next plan was to reformat the hard drive and start again.

Anyone any last gasp tips they could throw my way at all please???? - Tearing what little hair I have on my head out here

Cheers.

Mart

could be a memory problem mate

they are pretty random

try removing your memory one at a time to see if it dissappears

[turpieaj]

Sounds like a variant of the sasser worm (LSASS.exe). Have you tried starting up in safe mode (F8) whilst booting up, then do start>run>type msconfig in the text box and press enter>click on the start up tab and then if you could cut n paste what programs are listed there I might be able to help.

Andy

[old_skool_daze(Phil)]

This is a fantastic place to ask , very knowledgeable people
BleepingComputer.com (Powered by Invision Power Board)

[Mister_DJ]

Thanks for the response guys, much appreciated

Have tested the memory today at boot and its ok which makes me think its deffo a worm.

There's two entries on my start up tho that are dumprep (see attached).

Any ideas Andy?

Cheers,

Mart

[seandelier]

memory can be faulty witout showing up on boot test

sometimes physially removing it one at a time is the only way to diagnose

unlikely but alays a possibility

no idea what the dumprep is, have you tried googling it?

[Konspiracy]

Just did a quick google on dumprep and it seems its a Microsoft reporting tool

You can get rid of it

This might be a safer way to disable Dump Reporting DUMPREP.EXE -

1) Right click on “My Computer”
2) Choose menu item “Properties”
2) Click the “Advanced" tab
3) Click the “Error Reporting” button
4) Set the “Disable error reporting” checkbox to checked/ON
5) I recommend setting the “But notify me when critical errors occur” checkbox to checked/ON, but that is optional

[Mister_DJ]

Originally Posted by old_skool_daze

This is a fantastic place to ask , very knowledgeable people
BleepingComputer.com (Powered by Invision Power Board)

Have disabled the dumprep thing - cheers Neil

Also followed some bits that Andy kindly pm'd me

This website "bleepingcomputer", touch wood, has cracked it. They had a link to an online checker that found a couple of bits of malware not found on previous scans. Been a good 24 hrs and no annoying pop ups or shut downs

Thanks everyone for all your help - much much appreciated.



Mart

[wormaldinho]

Ha ha, thought ya were on about me!anthemz.com/forum/images/smilies/Grins.gif" border="0" alt="" title="big grin" class="inlineimg" />

[aka PABLO]

ok bar a re-format which you should do follow these steps

any file you dL off the net scan through here--> VIRUSTOTAL - Free Online Virus and Malware Scan

run this--> HijackThis Logfileauswertung
then run the log through this--> HijackThis Logfileauswertung

then run this--> http://www.bitdefender.com/scan8/
this--> Trend Micro HouseCall - Start
& this--> Windows Live OneCare safety scanner: Free online tool for PC health and safety

get all the anti spyware stuff scan--> 100-downloads.com | Top-100 downloads of free software & freeware for Windows XP & Vista

follow this tutorial of surfing the net--> Simple and easy ways to keep your computer safe and secure on the Internet

look though this--> Simple and easy ways to keep your computer safe and secure on the Internet

if your not cured do a re-format.

[just_jj]

I have a copy of enterprise level AV with huristic scanning.

It's the only AV in the world that has picked up all knows viruses and straines of viruses with out having an upto date signature database.

I will say that it does need a little technical knowledge to set it up and configure it properly so if your just a PC user and not really sure what your doing I wouldn't bother go for AVG lol

If anyones interested PM me.