Runtime error

[Guest]

Hello, I am getting a runtime error: runtime error program c:\windows\system32\lsaas.exe R6025 pure virtual function call

 

[shagrathdex666]

It's a virus infection and it has disabled your NAV, but i can help you fix it.





Please follow these steps, print out a copy of this instruction so you have it to follow it while doing the fixes.

1. First, you are going to need to download a special tool called CWShredder for the coolwebsearch hijacker so you will have it hand when we are ready to use it.

CWShredder.
Download it here:
http://www.spywareinfo.com/downloads/tools/CWShredder.exe

2. Then, make sure your PC is configured to show hidden files
How to Show Hidden Files
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

3. Reboot your PC into SAFE MODE

How to start the computer in Safe mode
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

4. Scan with HijackThis and when it finishes, put an x in the boxes next to these items, then press *fix checked*

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.ht...count_id=138770

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_page.ht...count_id=138770


R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.ht...count_id=138770

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.allhyperlinks.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.allhyperlinks.com/search.html

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O1 - Hosts: 216.40.230.4 desktop.kazaa.com
O1 - Hosts: 216.40.230.4 alpha.kazaa.com
O1 - Hosts: 216.40.230.4 shop.kazaa.com

O4 - HKLM\..\Run: [akyfww] C:\WINDOWS\ovzykbebj.exe

O4 - HKLM\..\Run: [System Log Event] csrss32.exe

O4 - HKLM\..\RunServices: [System Log Event] csrss32.exe

O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/roing.cab

O16 - DPF: {EF86873F-04C2-4A95-A373-5703C08EFC7B} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006_cracks.cab

5. While still in SAFE MODE, delete the following files and/or folders named in bold

ovzykbebj.exe

csrss32.exe

6. While still in SAFE MODE, now go to the CWShredder tool you downloaded earlier and open it up by clicking on the icon. Press the *Fix* button to run it (not the scan button). Let it fix what it finds. When done, press *next* and you will get the results, and then *exit*

7. Reboot back into normal mode and get an online AV scan immediately at one (preferably two) of the following:

Panda's Active Scan http://www.pandasoftware.com/activescan/co...n_principal.htm

Trend Micro (PC-cillin) - Free on-line Scan
http://housecall.antivirus.com

RAV Antivirus Online Scan
http://www.ravantivirus.com/scan/

eTrust AV web scanner (Computer Associates)
http://www3.ca.com/virusinfo/virusscan.aspx

Let them remove any infected files found.

8. Reboot your PC between each scan.

9. If your NAV is working again, get the latest updates and scan your system with that as well.

10. After all that is done, please scan once more with HijackThis and post a new log back here and let us know how you are doing at that point.

NOTE: If during the above you find you cannot access those sites, please search your system for a HOSTS file. If found, please rightclick to open and you'll get a popup box. Put a dot in *choose program to open* and then choose either Notepad or Wordpad to open it. If you see any entries inside starting with 127.0.0.* (where * is any number), delete those entries. Close the file and you should be able to access the sites you need. Not sure, but a reboot may be necessary after deleting the entries.