Re: XP Home shows 'lsass.exe' message

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Mattias, Ron -

Thanks to both of you for your messages of sympathy with this crappy
problem. The cause was found to be due to a nice new Trojan (weeded out
eventually by AVG7.5, running the P-B hard-drive in a dedicated test PC) -
but the Registry was still found to be corrupted and had to be fixed
separately.

So ... using MS's article 307545 as a guide, I forced a manual System
Restore by backing up and replacing the current (corrupt) Registry files
with copies of those from a Snapshot taken 2 days ago. I did this by file
substitution using the test PC (to get around all the risky typing in
Recovery Console, detailed in article 307545) after enabling the System
Volume Information folder(s) for full control, and the trick worked first go
(thank Providence).

Hope this helps you with the Acer laptop, Mattias - you might try
picking a likely Restore point from when the laptop definitely worked OK,
and then copy out/rename/apply the five replacement files that will make up
the new Registry. If the chosen restore point files fail to do the job,
simply go back a bit further and pick up five earlier files. Putting the
laptop hard-drive in a desktop PC (using a cable adaptor) will probably make
your task a lot easier. If you need email help, the address below now ends
with @aol.com instead of @tiscali.co.uk

Regards,

Philip



"Ron Martell" <ron.martell@xxxxxxxxx> wrote in message
news:vm74t298tt0u19dp6cjoj3d365iv4jfp2p@xxxxxxxxxx
"Philip Andrews" <philipfaeunst@xxxxxxxxxxxxx> wrote:

Hi,

Can anyone help or advise me please?

Out of the blue, my Packard-Bell PC running on XP Home has started
showing a message window at boot time:

"lsass.exe - System Error"

(and underneatht that, in the same window)

"Object Name not found"


When I click the 'OK' button to clear that window, the PC pauses for
about a minute and then reboots itself, returning to the same point each
time. Clicking 'OK' produces another reboot. This happens both in Normal
and
all Safe Modes: I can't get beyond that point.

The hard drive has been removed and run in another machine (wired up
as
secondary slave), checked for viruses and spyware (using AVG 7.5 and
Ad-Aware 6.0), and was found to contain only tracking cookies. My best
guess
is a possible Registry corruption, but I have no idea how it happened or
how
to deal with it. Reloading the whole thing would be a possible option, but
a
very aggravating one.

Help, please, all you kind and knowledgeable people!


"There's a strong possibility that this is a virus, unfortunately. The
LSASS process manages user logins, and as such is a common target for
infections on PCs running various versions of Windows."

Get a second opinion regarding possible virus/spyware infestations by
putting the hard drive back into the other machine and scanning it
with at least one of the following free online scanners:
Bit Defender http://www.bitdefender.com/scan8/ie.html
Trend Micro http://housecall.trendmicro.com
Kaspersky Online Scanner http://www.kaspersky.com/virusscanner
Panda ActiveScan http://www.pandasoftware.com/activescan
WindowSecurity.com TrojanScan http://windowssecurity.com/trojanscan
Webroot http://www.webroot.com/

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2006)
On-Line Help Computer Service
http://onlinehelp.bc.ca
Syberfix Remote Computer Repair

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."


.

Relevant Pages

  • Re: - Yahoo ups the ante, hijacks browsers through Adobe Reader 7
    ... One has to be a bit careful when deleting *everything* in the "Downloaded Objects" file. ... General tab. ... In the System Configuration Utility window, ... Remove all suspicious items from the registry ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: A question of dynamically moving controls (Drag and Drop)
    ... The dropped positions are saved in the registry and when the User opens the ... which is somewhere in the middle of the dialog window. ... I believe that if you are going to store things in the Registry, you should do so by using ... your information is screen-size dependent. ...
    (microsoft.public.vc.mfc)
  • Re: Please Help - MCX unable to connect
    ... expired and is throwing up a window which the MCX can't dismiss. ... >started my PC (the MCX was still in standby) and found the following Errors: ... >running the Media Center Experience, 'License Expiration Notice', with file ... >registry while an application or service was still using the registry during ...
    (microsoft.public.windows.mediacenter)
  • Re: A question of dynamically moving controls (Drag and Drop)
    ... The dropped positions are saved in the registry and when the User opens the ... which is somewhere in the middle of the dialog window. ... However, later when the User restarts, the moved control now appears about ... your information is screen-size dependent. ...
    (microsoft.public.vc.mfc)
  • Re: Averaging separate fields in a form, excluding blanks
    ... Ron, you've been great. ... > that goes in the Control Source of the field that will display the average. ... > function is working properly by trying it from the Immediate Window. ...
    (microsoft.public.access.forms)