- This topic has 6 replies, 4 voices, and was last updated 22 years, 4 months ago by
.
-
Posts
-
Hi
I recently formatted my computer to install windows XP. I created 2 partitions, a small one to install WinXP and a bigger one to store my own programs. The formatting was NTFS type.
Here’s the problem: after spendind a few minutes online my computer shuts down (with a warning and a one minute delay to give time to the user to save files) due to a lsass.exe file error or RPC error (note that this post was immediatly copied and pasted from a notepad file to the forum).
I returned to the store for an explanation, their response was that i’m using Norton Antivirus that has a hidden worm that shuts down WinXP (indeed i’m using Norton Antivirus 2003). Now I dont know if what they told me was true or not but they suggested I format my computer and reinstall WinXP but NOT install Norton.
Here’s the catch: my computer wont let me format my C local drive, where WinXP are installed.
I used 2 ways to format, one is to right click on the hard disk and select format. The message I get is the following:Quote:quote:Formatting Local Disk C
Windows cannot format this drive. Quit any disk utilities or other programms that are using this drive and make sure that no window is displaying the contents of the drive. Then try formatting again.Then I tried formatting from command prompt, I entered the command: format c:
the message I got was:Quote:quote:Format cannot run because the volume is in use by another process. Format may run if this volume is dismounted first. ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.. Would you like to force dismount on this volume? (Y/N)Wether the answer is y or n the message I get is the following:
Quote:quote:Cannot lock drive. The volume is still in use.I figured I should close as many programms running as possible. I pressed control+alt+delete and closed as many processes as I could.
Here are the processes that I could not close sorted by Image Name and User Namesvchost – LOCAL SERVICE (i can close this one but it reappears after a few seconds)
taskmgr.exe – (My user name)
explorer.exe – (My user name)
svchost – SYSTEM
svchost – SYSTEM
lsass.exe – SYSTEM (this is the suspected worm according to the computer store clerk, if I try closing this my computer shuts down, if I try deleting it manually it reappears)
winlogin.exe – SYSTEM
csvss.exe – SYSTEM
smss – SYSTEM
system – SYSTEM
system idle process – SYSTEM
spoolsv.exe – SYSTEM (i can close it but it reappears after a minute)Most of these processes could not be closed as they were described as critical system processes.
As you can see my hands are tied. I cant format my computer and I cant remove this worm. Needless to say that i’m killing for help as i’m already falling behind in my projects due to inability to access internet from my computer.
I’m using WinXP Professional, 56k dial up modem, internet explorer 6 and Norton Antivirus 2003.
Any help is greatly appreciated.That sounds like you have MSBlaster, or another Windows worm. Have you tried installing all the Windows updates?
Also, you can’t format the hard drive that windows is installed on while in windows, that just can’t work.
I did some research from a different computer and I seem to be dealing with the problem. The worm is related to lsass.exe file, and the RPC programm, from control panel/administrative tools/services/Remote Procedure Call (RPC)/recovery from there I switched all 3 actions to ”take no action” to deal with the RPC troubles. As for the lsass.exe file infection I should be able to find a patch, download and burn it from a different computer and apply it.
Now as for formatting which eventually will happen, how do I do it? David what you just posted was my conclusion but how do I proceed with formatting the drive that contains windows? also tried safe mode but it wouldnt work either. Suggestions for formatting winXP?Just inset the windows CD and turn on the computer, then you can boot off of the CD and the XP setup utility can format the hard disk for you.
You don’t need to format the drive…
When the shutdown prompt appears, go to your command prompt and type in (without quotes) “shutdown -a” . This will abort the shutdown so you can remain active on your computer. Then go to Microsoft.com and download the Sasser Worm removal tool.
Reformatting will just make you vulnerable once you reinstall XP and get online.
I had a problem simular to that one about a month ago I made a command to delaylsass.exe and created a shutdown wanring of 9999 seconds (maximum) so I did that plugged back in to the net it still shut down frustrated I rebooted with the windows disk booted to it. and completely formatted it and it perminently ended the prob:P lol I used FAT32.(quick) and it worked good hope that was some help to you…in any way
My problem was with the Welchia.E Sasser worm that was infecting the file lsass.exe
I formated windows just in case by entering setup and deleting the partition that contained the windowsXP installed components, then installed windows again.
I searched in Google and found a removal tool for the worm, that solved my problem. My next move was to update my computer as I had many critical updates to download to protect me from worms of such type.
This link is for the removal tool, if you’re dealing with this problem give it a go.
http://www.symantec.com/avcenter/FixWelch.exe
- You must be logged in to reply to this topic.