Runtime error



Hello, I am getting a runtime error: runtime error program c:\windows\system32\lsaas.exe R6025 pure virtual function call


Jun 9, 2009
It's a virus infection and it has disabled your NAV, but i can help you fix it.

Please follow these steps, print out a copy of this instruction so you have it to follow it while doing the fixes.

1. First, you are going to need to download a special tool called CWShredder for the coolwebsearch hijacker so you will have it hand when we are ready to use it.

Download it here:

2. Then, make sure your PC is configured to show hidden files
How to Show Hidden Files,,4155-1916458,00.html

3. Reboot your PC into SAFE MODE

How to start the computer in Safe mode

4. Scan with HijackThis and when it finishes, put an x in the boxes next to these items, then press *fix checked*

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O1 - Hosts:
O1 - Hosts:
O1 - Hosts:

O4 - HKLM\..\Run: [akyfww] C:\WINDOWS\ovzykbebj.exe

O4 - HKLM\..\Run: [System Log Event] csrss32.exe

O4 - HKLM\..\RunServices: [System Log Event] csrss32.exe

O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) -

O16 - DPF: {EF86873F-04C2-4A95-A373-5703C08EFC7B} (Installer Class) -

5. While still in SAFE MODE, delete the following files and/or folders named in bold



6. While still in SAFE MODE, now go to the CWShredder tool you downloaded earlier and open it up by clicking on the icon. Press the *Fix* button to run it (not the scan button). Let it fix what it finds. When done, press *next* and you will get the results, and then *exit*

7. Reboot back into normal mode and get an online AV scan immediately at one (preferably two) of the following:

Panda's Active Scan

Trend Micro (PC-cillin) - Free on-line Scan

RAV Antivirus Online Scan

eTrust AV web scanner (Computer Associates)

Let them remove any infected files found.

8. Reboot your PC between each scan.

9. If your NAV is working again, get the latest updates and scan your system with that as well.

10. After all that is done, please scan once more with HijackThis and post a new log back here and let us know how you are doing at that point.

NOTE: If during the above you find you cannot access those sites, please search your system for a HOSTS file. If found, please rightclick to open and you'll get a popup box. Put a dot in *choose program to open* and then choose either Notepad or Wordpad to open it. If you see any entries inside starting with 127.0.0.* (where * is any number), delete those entries. Close the file and you should be able to access the sites you need. Not sure, but a reboot may be necessary after deleting the entries.