PC keeps rebooting with lsass.exe password error

[fantomlord]

I have a pc with windows xp on it and it keeps rebooting with the same lsass.exe password error message. I even tried booting in safe mode but the same thing occurs. I tried hooking up the serial ata drive as a slave drive on a different pc and ran norton antivirus and ad aware in which it removed numerous viruses and spyware. The viruses found were as follows:
trojan.lukuspam
trojan.olfeb.a
trojan.eaghouse
pwsteal.bancos.t
adware.ndotnet
w32.beagle.bp@mm
w32.beagle.bn@mm
w32.beagle.gen
trojan.tooso.g
pwsteal.trojan
w32.beagle.dz
bloodhound.beagle
download.trojan
trojan.tabela.b

I also removed the lsass.exe file which seems to be related to the sasser worm. When i rebooted in safe mode the first time it seemed to remove the lsass.exe file but came up with a missing or corrupt hal.dll file. I rebooted in normal mode and copied an hal.dll file from the different pc and rebooted. Then the lsass.exe seemed to reappear. I even tried booting the windows disk to the recovey console. No luck. Any help would be greatly appreciated.

 

[bcastner]

Lsass.exe is a valid Windows file, if it is located in the %windir%\system32 directory, and has attributes such as, for SP2,:
C:\> dir C:\WINDOWS\system32\lsass.exe
08/03/04 12:26p -a------ 13312 bytes lsass.exe

The file is being replaced by the Windows file protection system. It can be deleted, see my notes here: thread779-1257634

But doing so will prevent you from logging into XP, if it is a valid XP file.

Without the exact error message I am reluctant to suggest anything but to do additional antivirus scans, as no single product will catch everything:

Start with the Microsoft Malicious Sofware Removal Tool:

http://www.microsoft.com/security/malwareremove/default.mspx

Then if necessary one or more of these free all files scans:
(I personally prefer the Trend Micro and Panda checkers, however they all work well.)

http://housecall.trendmicro.com/

http://www.mcafee.com/myapps/mfs/default.asp

http://security.symantec.com/default.asp?productid=symhome&langid=ie&;venid=sym

http://www.bitdefender.com/scan/licence.php

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

http://www.ravantivirus.com/scan/

http://www.freedom.net/viruscenter/index.html

You can scan single files using the following sites

http://www.kaspersky.com/remoteviruschk.html

http://www.ikarus-software.at/portal/modules.php?name=Content&pa=showpage&pid=4

 

[fantomlord]

the deleted lsass.exe file was in the c:\windows\system32 folder. When it was deleted according to your thread link it will be replaced with another lsass.exe file so why am i getting the lsass.exe error then. The exact error is as follows, (i have to reboot many times to write down the full error since it only stayed on the screen for a second or two.

Error is:

When trying to update password this return status indicates as the current password is not correct.

 

[bcastner]

Okay. This does not sound like Sasser.
Follow these instructions:

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

 

[fantomlord]

tried the dvd restore dvd that came with the pc and the windows recovery console but it still did not work.
It goes to the recovery console then im at a c: prompt.
I did a fixboot and now im getting a missing NTLDR file error when rebooting.

 

[bcastner]

Fixboot is not going to make it here. You have a corrupt SAM at least, and possibly corrupt registry hives.

Again, do this:

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

 

[bcastner]

If you still have NTLDR missing errors after the registry repair, see:

Create a boot disk:

http://support.microsoft.com/kb/305595/

Previous thread: thread779-720095
Good site for this issue:

http://www.computerhope.com/issues/ch000465.htm

 

[fantomlord]

in the windows system recovery console i only get a c: prompt not a c:\windows prompt where u just hit #1.

 

[bcastner]

1. Do a CD to see the current directory:

CD and CHDIR
Use the cd and chdir commands to change to a different folder. For example, you can use the following commands:
Type cd .. to change to the parent folder.
Type cd drive: to display the current folder in the specified drive.
Type cd without parameters to display the current drive and folder.
The chdir command treats spaces as delimiters. Because of this, you must put quotation marks ("") around a folder name that contains a space, for example:
cd "\windows\profiles\username\programs\start menu"
The chdir command works only in the system folders of the current installation of Windows, in removable media, in the root folder of any hard disk partition, or in the local installation sources.

2. You may as well do a bootcfg /rebuild

BOOTCFG
Use this command for boot configuration and recovery. This command has the following options:
bootcfg /add
bootcfg /rebuild
bootcfg /scan
bootcfg /list
bootcfg /disableredirect
bootcfg /redirect [portbaudrate] | [useBiosSettings]
Examples:
bootcfg /redirect com1 115200
bootcfg /redirect useBiosSettings
You can use the following options:
/add : Adds a Windows installation to the boot menu list.
/rebuild : Iterates through all Windows installations so that you can specify which installations to add.
/scan : Scans all disks for Windows installations and displays the results so that you can specify which installations to add.
/default : Sets the default boot entry.
/list : Lists the entries already in the boot menu list.
/disableredirect : Disables redirection in the boot loader.
/redirect : Enables redirection in the boot loader, with the specified config.

3. But none of these are addressing the issue of SAM and registry corruption discussed earlier.

 

[fantomlord]

tried copying ntldr and ntdetect.com from a floppy to the c drive and rebooted but im still getting the ntldr file is missing. Tried bootcfg and im getting a volume appears to contain one or more unrecoverable problems.
when i did a dir of the c drive a windows dir is not present.
What next?

 

[bcastner]

Run chkdsk /r from Recovery Console.

 

[linney]

Have you tried running ChkDsk /r from the Recovery Console?

The drive manufacturer will have free diagnostic software (usually converted to a bootable floppy to run on the machine in question) which will thoroughly check your hard drive for problems.

You Cannot Log On to Windows XP After Running the Out-of-Box Experience(Q316134)

http://support.microsoft.com/support/kb/articles/q316/1/34.asp

http://www.tek-tips.com/viewthread.cfm?qid=911974

 

[fantomlord]

chkdsk /r gives me a volume appears to contain one or more unrecoverable problems. serial volume has all zeros. Next?

 

[bcastner]

Recover your data if you can, and do a new clean install of XP with new partitions and a format.

I have not revised this in a while, so some links may be dead, but not all:
thread779-744465