[Resolved] lsass.exe problem

guest47 Topic Starter

Post #1November 6, 2007, 11:22 PM UTC last edited November 18, 2007, 9:12 AM UTC

Using procmon I see a constant repetition of a series of:

24626 23:52:35.6518633 lsass.exe 760 RegCloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS
24627 23:52:35.6518719 lsass.exe 760 RegOpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Desired Access: Read
24628 23:52:35.6518915 lsass.exe 760 RegQueryValue HKLM\SECURITY\Policy\SecDesc\(Default) SUCCESS Type: REG_NONE, Length: 180, Data:
24629 23:52:35.6519030 lsass.exe 760 RegCloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS
24630 23:52:35.6521351 lsass.exe 760 RegCloseKey HKLM\SECURITY\Policy SUCCESS
25203 23:52:35.6984010 lsass.exe 760 RegOpenKey HKLM\SECURITY\Policy SUCCESS Desired Access: Read/Write
25204 23:52:35.6984223 lsass.exe 760 RegOpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Desired Access: Read
25205 23:52:35.6984418 lsass.exe 760 RegQueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFFER OVERFLOW Length: 12

Intermittently interspersed with:

14311 00:00:42.4722360 lsass.exe 760 RegOpenKey HKLM\SAM\SAM\DOMAINS\Account\Groups\Names\Zen NAME NOT FOUND Desired Access: Read
14312 00:00:42.4722536 lsass.exe 760 RegOpenKey HKLM\SAM\SAM\DOMAINS\Account\Aliases\Names\Zen NAME NOT FOUND Desired Access: Read
14313 00:00:42.4722676 lsass.exe 760 RegOpenKey HKLM\SAM\SAM\DOMAINS\Account\Users\Names\Zen SUCCESS Desired Access: Read
14314 00:00:42.4722874 lsass.exe 760 RegQueryValue HKLM\SAM\SAM\Domains\Account\Users\Names\Zen\(Default) SUCCESS Type: , Length: 0
14315 00:00:42.4723025 lsass.exe 760 RegCloseKey HKLM\SAM\SAM\Domains\Account\Users\Names\Zen SUCCESS

For reasons which unfortunately I cannot recall, I believe however related to attempts to repair my declining system performance, I started up procmon to see if anything was off, and noticed this. It is constant as far as I have been able to tell, opening procmon and having it run for spells at various times of the day.

I have performed the self help ritual as prescribed before posting. I have had a full AVG home suite installed for some time but (frustratingly for me thus far) being unable to actually access the particulars of the individual programs installed (like AntiSpyware) with it I decided it was best to simply download the AVG AntiSpyware trial as indicated and ran that during safemode. It successfully removed with no option for quarantine a plethora of tracking cookies and that was it.

I'm unsure if this lsass.exe stuff is a problem, and I was hoping if you could help. Please forgive me if it is normal, I do not intend to waste your time. I use Firefox. Here is the HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 00:03:38, on 07.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
d:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
G:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
d:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
d:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
d:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
d:\PROGRA~1\Grisoft\AVG7\avgemc.exe
d:\Program Files\Gizmo Project\mDNSResponder.exe
d:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Google\Google Talk\googletalk.exe
G:\WINDOWS\system32\wscntfy.exe
G:\WINDOWS\system32\ctfmon.exe
G:\WINDOWS\system32\devldr32.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
G:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
G:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
G:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
D:\Program Files\PeerGuardian2\pg2.exe
D:\Program Files\EVEMon\EVEMon.exe
G:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\WINDOWS\Explorer.EXE
k:\shared\monitors\Procmon.exe
D:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/no/ý
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - d:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - d:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [googletalk] G:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [AVG7_CC] d:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [StatusClient] G:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] G:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Gizmo Project] "D:\Program Files\Gizmo Project\Gizmo.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] d:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [EVEMon] "D:\Program Files\EVEMon\EVEMon.exe" -startMinimized
O4 - Startup: ATI Tray Tools.lnk = G:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.exe
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: g:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: g:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: g:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: g:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: g:\windows\system32\avgfwafu.dll
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: Tabbed Browsing
O20 - Winlogon Notify: avgwlntf - G:\WINDOWS\SYSTEM32\avgwlntf.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - d:\Program Files\Gizmo Project\mDNSResponder.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Unknown owner - g:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe (file missing)
O23 - Service: LVSrvLauncher - Logitech Inc. - G:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Ahead\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe

Thank you very much for your time.

Scotty

Post #2November 21, 2007, 8:53 PM UTC

Hello and welcome to the forum.

Sorry about the delay in responding

If you still need help, Scan again with HijackThis, and "copy/paste" a new log file into this thread.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Also please describe how your computer behaves at the moment.

guest47

Post #3November 24, 2007, 2:12 PM UTC

Thank you very much for responding and I apologize for missing it these last couple of days, but I today I decided I'm going to back things up this week and reinstall the OS. I appreciate the help, however and I hope you don't mind if I write back if the problem reemerges after I've stuck some things back on the machine.

Scotty

Post #4November 24, 2007, 2:50 PM UTC

I will leave this open for the 5 days.

Scotty

Post #5November 30, 2007, 4:22 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

✨ Ask AI

Ask AI