Runtime error

Hello, I am getting a runtime error: runtime error program c:\windows\system32\lsaas.exe R6025 pure virtual function call
1 answer Last reply
More about runtime error
  1. It's a virus infection and it has disabled your NAV, but i can help you fix it.


    Please follow these steps, print out a copy of this instruction so you have it to follow it while doing the fixes.

    1. First, you are going to need to download a special tool called CWShredder for the coolwebsearch hijacker so you will have it hand when we are ready to use it.

    CWShredder.
    Download it here:
    http://www.spywareinfo.com/downloads/tools/CWShredder.exe

    2. Then, make sure your PC is configured to show hidden files
    How to Show Hidden Files
    http://www.xtra.co.nz/help/0,,4155-1916458,00.html

    3. Reboot your PC into SAFE MODE

    How to start the computer in Safe mode
    http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

    4. Scan with HijackThis and when it finishes, put an x in the boxes next to these items, then press *fix checked*

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.ht...count_id=138770

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_page.ht...count_id=138770


    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.ht...count_id=138770

    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.allhyperlinks.com/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.allhyperlinks.com/search.html

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

    O1 - Hosts: 216.40.230.4 desktop.kazaa.com
    O1 - Hosts: 216.40.230.4 alpha.kazaa.com
    O1 - Hosts: 216.40.230.4 shop.kazaa.com

    O4 - HKLM\..\Run: [akyfww] C:\WINDOWS\ovzykbebj.exe

    O4 - HKLM\..\Run: [System Log Event] csrss32.exe

    O4 - HKLM\..\RunServices: [System Log Event] csrss32.exe

    O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/roing.cab

    O16 - DPF: {EF86873F-04C2-4A95-A373-5703C08EFC7B} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006_cracks.cab

    5. While still in SAFE MODE, delete the following files and/or folders named in bold

    ovzykbebj.exe

    csrss32.exe

    6. While still in SAFE MODE, now go to the CWShredder tool you downloaded earlier and open it up by clicking on the icon. Press the *Fix* button to run it (not the scan button). Let it fix what it finds. When done, press *next* and you will get the results, and then *exit*

    7. Reboot back into normal mode and get an online AV scan immediately at one (preferably two) of the following:

    Panda's Active Scan http://www.pandasoftware.com/activescan/co...n_principal.htm

    Trend Micro (PC-cillin) - Free on-line Scan
    http://housecall.antivirus.com

    RAV Antivirus Online Scan
    http://www.ravantivirus.com/scan/

    eTrust AV web scanner (Computer Associates)
    http://www3.ca.com/virusinfo/virusscan.aspx

    Let them remove any infected files found.

    8. Reboot your PC between each scan.

    9. If your NAV is working again, get the latest updates and scan your system with that as well.

    10. After all that is done, please scan once more with HijackThis and post a new log back here and let us know how you are doing at that point.

    NOTE: If during the above you find you cannot access those sites, please search your system for a HOSTS file. If found, please rightclick to open and you'll get a popup box. Put a dot in *choose program to open* and then choose either Notepad or Wordpad to open it. If you see any entries inside starting with 127.0.0.* (where * is any number), delete those entries. Close the file and you should be able to access the sites you need. Not sure, but a reboot may be necessary after deleting the entries.
Ask a new question

Read More

CPUs Runtime System32