lsass.exe error: current password not correct 3

[supereagles]

when i start my computer, the system halts. the window titled "lsass.exe" gives the message that "when trying to update a password, this return status indicates that the value provided as the current password is not correct." this process repeats if uninterupted.

I believe that I have been hacked and that some script is attempting to install a backdoor by setting up a new administrative account.

I have not been able to start up the machine in safe mode or any mode.

Any suggestions?

 

[jpm121]

LSASS.EXE is part of Windows, residing in %systemroot%\system32\. Properties show it is the "LSA Shell" (thanks a lot, right??) That stands for Local Security Authority.

So, it's supposed to be there, and it's supposed to be running. It's loaded early in the startup process, and it's the program that authenticates usernames and passwords when you log in.

Unfortunately I couldn't find much on error messages, but you might poke around on technet and try different search combos. Hope this gets you started in the right direction...

 

[mudskipper]

I have had a few XP boxes with the same error. Some of them happened for no good reason, but after some poking around, we finally wiped/reloaded (was easier than fiddling with it for days on end).

On a couple of those machines, it was a problem with the system shutting down faster than the hard drive could close everything out properly. This was causing windows to become corrupted, resulting in our little error.

I don't know specifically how to fix it, but after you get running again (in whatever fashion), you might try to slow down your boot process (sometimes turning off write caching in the device manager will assist in this, but slows down performance quite a bit). Check w/others or MS for other options to slow your shutdown time (I can't remember what exactly we did to slow it on those machines).

Good luck, hope it helps.

 

[linney]

Some reading for you but short on solutions.

http://groups.google.com/groups?q=lsass.exe+password+windows+xp&hl=en&lr=&start=10&sa=N

You could try repairing windows itself by running it over itself. You will lose all your windows updates but your files will be untouched.

REPAIR WINDOWS

Boot from XP CD
(Windows will now load some temporary files)


Options after booting

*To Set Up Windows XP now press ENTER

*To Repair a Windows XP installation using Recovery Console, press R

*To Quit Setup without installing Windows XP, press F3


Press ENTER for first option (don't select Recovery Console)
(Accept Eula agreement)

Follow onscreen instructions to repair windows installation.



How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

 

[supereagles]

Thanks all for your help. The issue could not be resolved by MS or Dell. However, there is a potential fix covered by MS Knowledge Base article Q308402:

http://support.microsoft.com/search/preview.aspx?scid=kb;en-us;Q308402

 

[Present]

same problem here, no idea why except i had a few bluescreens before it happened with "irq_cp less than or equal to" on them a few times. I'm going to try and reinstall windows with the repair option.

 

[Present]

Damn! tried that, all goes through, reboots to the usual 640x480 res that it normally starts a windows install in, then the same error!!

can anyone think of a work-around before i have to reinstall my whole system and all my software (again!)

cheers,

Bill.

 

[linney]

You may want to try this to see if you can save your files.

An easy to follow recovery console description when unable to start computer due to corrupt registry.

http://www.mediaworkstation.com/htm/homeset1.htm

Click on Tutorial then the Charlie White article on XP crash.
This is a laymans version of Q307545 in simple language.


This is the latest from Microsoft on this error.

You Cannot Log On to Windows XP After Running the Out-of-Box Experience(Q316134)

http://support.microsoft.com/support/kb/articles/q316/1/34.asp

 

[Present]

Came across Q307545 myself by accident earlier today - ran through it and the problems gone thank God!

Regards,

Bill.