RE: lsass.exe - system error / Object Name not found.

"nass" wrote:



"GRIZZ" wrote:

Okay....before I start, we'll get this out of the way. I am a VERY ADVANCED
user who is stumped. I have been working on this issue for 7 days (when I am
home from work). I have hit my head on the wall so many times that now I am
going to need some paint to cover the bloody circles. I have read over 200
posts from GOOGLE, MSKB, MajorGeeks, and about 50 others about solutions to
this problem; none of them have helped. This is going to be a LOOOOOONG
post, as I am going to provide as much information as possible with the hopes
that someone has survived this and can give me STEP-BY-STEP way to correct it.

Just so that you know, I have been running this system since 01/03/2006 with
the same load, the files in the C:\WINDOWS\REPAIR folder are dated then - I
am not going to use them...as I have 100's of applications on my machine that
have been installed since the install. I have SYMANTEC Internet Security
2008 (all updates - scans every Friday).

It all started last Friday (11 APR 2008). I rarely reboot my machine, but
overnight it had scanned my system, found something and I got up to a
::greyed:: desktop and a dialogue box telling me that my system was cleaned
and I needed to reboot. Only button was an [OK]. I clicked it and
Oingo-Boingo the machine began a reboot. When the system got almost to the
LOGON screen, another dialogur box popped up with the following
error/warning: lsass.exe - system error (and inside it Object Name not
found.). It had only the [OK] button to click. I could not get to the pass
word prompt to type in my password so I clicked [OK]. When I did the machine
rebooted. It came back to the same screen, and I "MOVED" the dialogue box
out of the way and tried to type in my password...no-go! Nothing was showing
in the box. I clicked [OK] again and the machine rebooted. Here is where
the nightmare begins. I went to the other room and got my laptop and set it
on the desk next to me to have a way to get to the Internet. Thinking I had
a virus, I searched on lsass.exe and virus.

It had about 12,450 hits. Boy O Boy, I thought...let's start reading. I
chose sites that I have used in the past to resolve other issues (I have my
own computer repair/consulting business) and each of them mentioned the
SASSER virus. I was never notified that I had a virus, but it is possible
that I got one. One of the pages talked about using the XP CD to go to the
recovery console. OK, I said...I'll give that a try first. I booted off my
slipstreamed SP2 XP PRO CD, and when prompted to enter my ADMINISTRATOR
password...I did. WHAMO-BLAMO, I am told the password is incorrect. Ok, I
know I am not crazy - when I setup/install any version of XP on any machine -
even ones that I do for customers, I always, ALWAYS use the same 10 character
password (letters and numbers) - it is my backdoor should I ever need to get
into the machine due to a corrupted user account. I checked, my CAPS LOCK
was not on. I typed it again, slowly; same response. I tried leaving it
blank, same response - but also told 3 incorrect password entries - press any
key to reboot. I did. Booted to the recovery console again, and tried the
password again in all caps, and mixed case (3 more times). OK, back to the
Internet. I then found a solution which used the REPAIR INSTALLATION option.
I was a little weary but tried it anyway (after I made FULL BACKUP of my C:
drive to and external HDD). I booted off XP CD, and went passed the REPAIR
USING RECOVERY CONSOLE option, and it found my installation of XP. I told it
to REPAIR it. It started the copying files and stuff, I went to the other
room, and came back to the GUI'ed screen asking for LOCALE settings (i.e.,
United States etc. - the first screen during and install where user input is
required). I followed the screens, input my PRODUCT KEY, and the
installation proceeded. I got to some point and the machine showed 39
minutes remaining. Then the lsass.exe box popped up. I screamed the "F"
word, and watched the HDD light stop, the CD light stop and let it sit for 15
minutes...the 39 minutes never changed. I took the plunge and clicked on
[OK]. The machine rebooted, and I was presented with the SETUP IS
CONTINUING.... screen when the machine rebooted (off the HDD). It showed the
same 39 minutes screen (the ads are cycling), and the lsass.exe window still
there. I again booted off the CD and tried to do a REPAIR install
again....it told me that one was in progress and it would continue it. Every
time I get the lsass.exe error.

I have also tried the RECOVERY CONSOLE off the XP CD, trying the RESTORE TO
LAST GOOD, the SYSTEM RESTORE (apparently all the restore points are
corrupted/contaminated as well).

OKAY. I said - let's dig harder. I got the Ultimate Boot CD for Windows as
referenced on another site, got it built on my laptop and tried it.
Meanwhile I had also installed a FRESH copy of Windows XP Pro onto another
partition on the whacked system (I have over 1TB of storage), and it does
boot & I can see the other Windows install on the C: drive. On the 2nd
install I chose NO PASSWORD for the ADMINISTRATOR account, and created a
DIFFERENT user name for the initial account.

I booted off the UBCD and it finds both of the Windows installs, and I can
see all the accounts on my ORIGINAL load. I tried all the REGISTRY
REPAIR/CLEANING tools, etc available to me on the UBCD. I still get the
lsass.exe error when I boot to the HDD and it is still trying to complete the
installation (stuck on the 39 minutes remaining).

So here we sit. I have BLANKED the passwords on the accounts from the
original install (using the UBCD option to do this). Still the RECOVERY
CONSOLE says my password is incorrect. The registry files have all been
cleaned/repaired/primed/painted/sanded/stained/gloss coated and waxed (hah
hah) using every tool that I can think of....but I cannot get passed the DAMN
lsass.exe error.

I really do not want to have to RELOAD this PC and put back all my software.
I do have a backup of the C: drive dated 12/10/2007 - but I have installed
many things since then, performed many tweaks etc., and I do not want to go
back that far.

So my question of MICROSOFT (or anyone), how do I correct this error - get
my system to let me back in (after it completes the INSTALLATION - or is
there a WAY to UNDO that?)? Can the INCOMPLETE installation be UNDONE - or
stopped?

Please HELP!!!

Sincerely,
Curtis

Hi Curt,
I feel your Pain!.

Did you scanned the HDD by hooking it up as slave to another machine with
all the horse power you got to scan for malware and viruses?.
You didn't elaborate on the what given you the message about something is
the Anti-virus or a system message? forgive me *** need to imagine the
scenario to live the moment.

You can rename the file Lsass.exe/Isass.exe by hooking the troublesome HDD
to another machine after scanning and locate these directory:
C:\windows\system32\lsass.exe

C:\windows\system32\dllcache\lsass.exe

Rename them to Isass.exe.OLD and Restart with troublesome HDD as A primary
(back as it was) boot option and see if it will boot up okay, any progress?.

Or you can copy the file Isass.exe from another machine to the same
directories:
C:\windows\system32
C:\windows\system32\dllcache
Reboot the HDD as primary or put it back in its case as Primary Drive
(change the jumper= sorry I need to confirm), are there is any difference?.

It is just a guess but did you hear about the WXY MBR Boot Virus that reside
on the MBR Boot sectors of the HDD, not easy to remove and a clean install is
the only option to get it OFF the machine.
HTH.
nass
---
http://www.nasstec.co.uk

nass,

I have tried the RENAMING of lsass.exe to something else. DOES NOT WORK.
I coped the lsass.exe from the (2nd installed WORKING copy of XP). The
boot.ini file has the NON-WORKING version (C:\WINDOWS) and the WORKING
(E:\WINDOWS) versions listed.

If I boot to the WORKING version, I can see the C:\WINDOWS files and move,
delete, rename, etc. any of them - as they are not being used. If I boot to
the NON-WORKING version - it tries to COMPLETE the installation of XP (ontop
of what was there). It shows the lsass.exe ERROR and the background shows
the installation process at 39 minutes remaining. I have let it sit like
that for 4 hours and it never changes.

I wish I had never tried the REPAIR INSTALLATION process, as it appears
that I cannot BACK OUT of that. (I am sure there are files someplace that
Windows sees upon booting that kicks off the SETUP PROCESS (I just cannot
find them).

I mean, this should not be this hard. Every tool that I have tried will
show me the REGISTRY, show me the accounts that were on the OLD version of
Windows....but every damn time I think I have it fixed...the damn lsass.exe
issue comes back.

Any other suggestions???

.