Jump to content


Photo

KaIx from Guatemala


  • Please log in to reply
1 reply to this topic

#1 KaIx

KaIx

    Member

  • New Member
  • Pip
  • 1 posts

Posted 12 June 2007 - 06:29 PM

I think it's sasser since every time I turn the server on, a message of forced shutdown appears, and it mentions lsass.exe...
pls help me...

I have win 2k server with service pack 4.

LOG:
------

Logfile of HijackThis v1.99.1
Scan saved at 17:15:53, on 12/06/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Network Registrar\BIN\aicservagt.exe
C:\Program Files\Network Registrar\bin\mcdsvr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Registrar\bin\aiclockmgr.exe
C:\Archivos de programa\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Network Registrar\bin\dns.exe
C:\Program Files\Network Registrar\bin\dhcp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\system32\Dfssvc.exe
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINNT\system32\Isass.exe
C:\WINNT\system32\dload.exe
C:\WINNT\system32\internat.exe
C:\Archivos de programa\WinZip\WZQKPICK.EXE
C:\Program Files\Klever\Nothings\PumpKIN.exe
C:\Archivos de programa\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\explorer.exe
C:\WINNT\System32\mdm.exe
C:\Archivos de programa\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O3 - Toolbar: @msdxmLC.dll,-1@3082,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\system32\Isass.exe
O4 - HKLM\..\Run: [msvccc66] dload.exe
O4 - HKLM\..\RunServices: [msvccc66] dload.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Network Registrar 5.5.6.lnk = C:\Program Files\Network Registrar\BIN\ntwkreg.exe
O4 - Startup: PumpKIN.lnk = C:\Program Files\Klever\Nothings\PumpKIN.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Archivos de programa\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/spanish/msn
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.microsoft.com/spanish/msn
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5A38706-3079-47A5-8938-EA322C2AC28B}: NameServer = 200.35.174.126,200.35.174.127
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4A736B5-8FDF-4D57-83E9-54F6238086A3}: NameServer = 200.35.174.126,200.35.174.127
O23 - Service: AIC Server Agent 2.0 - Unknown owner - C:\Program Files\Network Registrar\BIN\aicservagt.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Servicio del administrador de discos lógicos (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Archivos de programa\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Archivos de programa\Firebird\Firebird_1_5\bin\fbserver.exe

#2 SWI Support Robot

SWI Support Robot

    Helper robot

  • SWI Bot
  • PipPipPipPipPip
  • 23,521 posts

Posted 15 June 2007 - 06:30 AM

Welcome to SWI. We apologize for the delay; our helpers have been very busy.
If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Thank you for your patience.

[this is an automated reply]
This is an automated message. It does not count as help.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button