rikkkki

Very interesting I just did a system search using a capitol L and came up with same results. BUT I have noticed that on different forums/sites that it is spelled the two different ways and I'm wondering if somewhere there might be a difference. When I type capital L and small l It's two different things as you can see. :icon_scratch: Hold it. The capitol I is the same as the small l . The mystery continues

If you mean a copy of Pauls "fix" I can do that. I just put the whole thing in notepad and can email it to MS :haha: I sure hope it doesn't come to tossing it out the window. Last resort is clean install :cry: Get this, MS told me to make a screen shot of the error and then open mspaint and do some clicking around and then save to an email. Well no matter how you cut it, it ends up an attachment. Well they told me not to send it as an attachment cause it will be lost :!: So I took matters into my own hands (long story short) I opened a new email and went to insert and selected picture went to browse and selected screenshot and clicked OK and guess what? Picture is IN email :!: :icon_scratch: It seems that is what they should have a guy do in the first place

HI cak46 I guess I was mixing two things with one. I searched the registry for the multiple dll thing and the hard drive for the lsass.exe. Microsoft finally came out of their shell and told me to go ahead and delete the dll entry/no results. I now have two entries on HD for lsass, one is right where it's supposed to be and has no virus and the other is in the Windows/software distribution/download file. Looks legit. They also had me turn off all services except MS and all startups/ no results. I just sent them a screenshot of my screen with the error on it. Still waiting for a word about that. I also noticed that Paul's fix was never replied to :icon_scratch: Hummmm, I can do what he says, but I'm not sure I could undo it :!:

OK good idea, I shall keep an eye out for any replies. I hope it's not something that's "too good to be true" It is something that I can do although I don't want something else to " pop up" when I get done doing it :!:

Hi out there :!: This time I'm not going to be a "hero" and try this myself without some feedback from you guys :o try this link and read what Paul Ramsey has to say about how he go rid of the lsass.exe problem. About half way down.

New info :!: May have solution. No time to xplain now, will post tomorrow after I try it :icon_study:

I had already tried a search with the registry but of course that's not a file. Then I just now tried a search of the value and came up with nothing. The funny thing is this started on Saturday when I was right in middle of researching lsass.exe and when I was " ending process" on task manager. When I clicked on lsass a window came up and told me that this cannot be deleted, so I clicked OK. and that was that. I was having trouble installing a new game, support told me delete everything except explorer and system tray. Well with XP that cannot be done. Later in the afternoon the window started popping up :!:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_DLLs Value: 9vs7sxtxnn585u.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll Here is the actual path in my registry and the value is from the properties and I think that's as far as I can go with it :icon_study: Unless there is another way to try.

Well Cak46 I hope that they can get ahead of me somewhere along the line so that we can be on the same page :!: I seriously feel that I do not have a virus. I think it's something like a true system error like the little box says, cause it will not reboot if I wait about ten minutes before I click OK. I mean, it's not the famous "60 second countdown" :!:

Well-update, maybe. I told Microsoft yesterday that I had run an HT scan and that it had a suspicious multiple dll listing in the log. Well, they wrote me back and said to go ahead and download HT and run a scan/log and send it to them :!: :!: Ah, HELLO, Microsoft, how did I run the scan if I didn't have HT in the first place>??? :haha: After I got done laughing I went ahead and sent them the same thing that I posted here in this forum. Sometimes I think that I am a day ahead of them :!: :!: ;)

Well, my system is running pretty good though Linkline still shows nothing more than 4.8. Maybe that system is an old one cause Speakeasy still shows right around 6. BUT 200? Oh ya, I could live with that. Right now I'd be happy with 25 :!: :!:

Well, at least I have never found lsass.exe in my startups anywhere. I'm composing a letter to MS right now and I copied and pasted that goofy looking dll dlll...... thing in there to give them something to think about

Just a note: TUT says that if you have lsass.exe in your startups then you have a virus. Mine runs right where it's supposed to, in the tasks and the path is correct...............

Hey guys. Ya answersthatwork.com is the program that I was talking about. I have it and it is VERY helpful with MANY different things. It's called TUT ( The Ultimate Troubleshooter) I was also VERY suspicious about my entry that had all those dlls tagged on the end. Highjack This says that generally Trojan types use this

StartupList report, 6/14/2005, 8:49:37 PM I already got rid of "House Call Control" It is not something that I'm familiar with at all StartupList version: 1.52.2 Started from : C:Program FilesHIJACKhijackthisHijackThis.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:Program FilesAheadInCDInCDsrv.exe C:WINDOWSsystem32LEXBCES.EXE C:WINDOWSsystem32spoolsv.exe C:WINDOWSExplorer.EXE C:PROGRA~1mcafee.comagentmcagent.exe C:PROGRA~1McAfee.comPERSON~1MpfTray.exe C:PROGRA~1mcafee.comvsomcvsshld.exe c:progra~1mcafee.comvsomcvsescn.exe C:Program FilesLogitechMouseWaresystemem_exec.exe C:PROGRA~1McAfee.comPERSON~1MpfAgent.exe C:Program FilesExecutive SoftwareDiskeeperDkService.exe c:PROGRA~1mcafee.comvsomcvsrte.exe C:PROGRA~1McAfee.comPERSON~1MPFSERVICE.exe C:WINDOWSsystem32nvsvc32.exe c:PROGRA~1mcafee.comvsomcshield.exe C:Program FilesOutlook Expressmsimn.exe C:Program FilesInternet Exploreriexplore.exe C:Program FilesHIJACKhijackthisHijackThis.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogon] UserInit = C:WINDOWSsystem32userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLMSoftwareMicrosoftWindowsCurrentVersionRun Logitech Utility = Logi_MwX.Exe MCUpdateExe = C:PROGRA~1mcafee.comagentMcUpdate.exe MCAgentExe = c:PROGRA~1mcafee.comagentmcagent.exe MPFExe = C:PROGRA~1McAfee.comPERSON~1MpfTray.exe VirusScan Online = "c:PROGRA~1mcafee.comvsomcvsshld.exe" NvCplDaemon = RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup VSOCheckTask = "c:PROGRA~1mcafee.comvsomcmnhdlr.exe" /checktask -------------------------------------------------- Load/Run keys from C:WINDOWSWIN.INI: load=*INI section not found* run=*INI section not found* Load/Run keys from Registry: HKLM..Windows NTCurrentVersionWinLogon: load=*Registry value not found* HKLM..Windows NTCurrentVersionWinLogon: run=*Registry value not found* HKLM..WindowsCurrentVersionWinLogon: load=*Registry key not found* HKLM..WindowsCurrentVersionWinLogon: run=*Registry key not found* HKCU..Windows NTCurrentVersionWinLogon: load=*Registry value not found* HKCU..Windows NTCurrentVersionWinLogon: run=*Registry value not found* HKCU..WindowsCurrentVersionWinLogon: load=*Registry key not found* HKCU..WindowsCurrentVersionWinLogon: run=*Registry key not found* HKCU..Windows NTCurrentVersionWindows: load= HKCU..Windows NTCurrentVersionWindows: run=*Registry value not found* HKLM..Windows NTCurrentVersionWindows: load=*Registry value not found* HKLM..Windows NTCurrentVersionWindows: run=*Registry value not found* HKLM..Windows NTCurrentVersionWindows: AppInit_DLLs=9vs7sxtxnn585u.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll -------------------------------------------------- Shell & screensaver key from C:WINDOWSSYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:WINDOWSsystem32logon.scr drivers=*Registry value not found* Policies Shell key: HKCU..Policies: Shell=*Registry key not found* HKLM..Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:PROGRA~1SPYBOT~1SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F} -------------------------------------------------- Enumerating Task Scheduler jobs: McAfee.com Update Check (DAVE-Martine).job -------------------------------------------------- Enumerating Download Program Files: [QuickTime Object] InProcServer32 = C:Program FilesQuickTimeQTPlugin.ocx CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab [PCPitstop Utility] InProcServer32 = C:WINDOWSDownloaded Program FilesPCPitstop.dll CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB [{13E23C9E-3018-4AC1-B998-C08BF1814DB0}] CODEBASE = http://ftp.gurunet.com/pub/cabs/GNInstaller.cab [iCC Class] InProcServer32 = C:WINDOWSDownloaded Program FilespcpConnCheck.dll CODEBASE = http://www.pcpitstop.com/internet/pcpConnCheck.cab [{3334504D-9980-0010-8000-00AA00389B71}] CODEBASE = http://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB [{33564D57-0000-0010-8000-00AA00389B71}] CODEBASE = http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB [Microsoft.WinRep] InProcServer32 = C:WINDOWSSystem32Winrep.dll CODEBASE = https://webresponse.one.microsoft.com/OAS/ActiveX/winrep.cab [McAfee.com Operating System Class] InProcServer32 = C:WINDOWSsystem32mcinsctl.dll CODEBASE = http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab [HouseCall Control] InProcServer32 = C:WINDOWSDOWNLO~1xscan53.ocx CODEBASE = http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab [DwnldGroupMgr Class] InProcServer32 = C:WINDOWSsystem32McGDMgr.dll CODEBASE = http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab [shockwave Flash Object] InProcServer32 = C:WINDOWSsystem32macromedflashFlash.ocx CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:WINDOWSsystem32SHELL32.dll CDBurn: C:WINDOWSsystem32SHELL32.dll WebCheck: C:WINDOWSsystem32webcheck.dll SysTray: C:WINDOWSsystem32stobject.dll -------------------------------------------------- End of report, 6,920 bytes Report generated in 0.016 seconds Command line options:

OK, I'll give it a try. Back soon :icon_study:

Well, I just ran Microsoft's Malicious Software Removal Tool and came up with nada. I sure hope that Microsoft comes

Wow!!!! So much info!!!! Thank you all!!!!!!!

Well, I have scanned my puter every which way but sideways including in safe mode. Can't find any virus. If I could just get rid of the dialogue box and not the lsass.exe for sure, then I would be in good shape!!!!!!!!!!!!!! :confused4: :confused4: :confused3: :confused2:

I finally got the lsass.exe plague Saturday!!!!!!!!!!!!! The little window that pops up and tells you "Object Name Not Found" If clicked OK or X it out it will reboot. I did find out that if you wait maybe ten minutes or so that when you close the window it will not reboot. Still a pain. Sunday I went down and bought XP Pro and installed it and guess what? It's still there!!!!!!!!!!!!!!!!! Any ideas on how to rid myself of this pest?????????????? : : :angry5: :angry5: :angry3:

Well, I think for now, I'll just leave that part of my settings alone. It's probably more trouble than it's worth? Thanks

Is there an advantage to manually putting in dns addresses maybe for faster speed? If so, where could one find a list of dns addresses, if there is such a list? I'm using dhcp now. : :confused1: :? :?

Thank you pitbull481. I've been doing some testing through Speakeasy from different parts of the country. boston shows 5.5 but Chicago,Dallas,LA,SF,And Michigan all show 6 to 6.115. Maybe I am getting what I'm paying for

Ya, I'm supposed to be getting 6 but this site shows an average of 4.9. Dsl Reports shows up to 5 on Linkline. MegaPath and Speakeasy show 5.8 to 6. BUT, for over a year Linkline has always been consistent with the speed that I was paying for until I bumped to 6. The "techs" keep telling me everything is running "well" If Linkline would show 6, then I would be a happy camper!!!!!!!!!!!!!!!!