PDA

View Full Version : lsass.exe - system error



timaru2007
04-11-2007, 05:18 PM
Hi all

my sister in law has just handed me her laptop which when attempting to start up displays the following message:

lsass.exe - system error. Object name not found.

Once OK is selected the laptop shuts down again.

Laptop is a HP pavilion ze4300 with XP home. Have no other details of the laptop.

Tried restarting using safe mode and safe mode with command prompt and last known good configuration and a couple of other options that are available after pressing F8 on startup. All to no effect. All that happens is the error message pops up and laptop shuts down when OK is selected.

We are still trying to find the original restore disc, but have tried an old copy of XP home I have lying around to see if a repair is possible.
It is not as I am asked for an administrator password. When this is entered it tells me I used the wrong password.

Have googled the problem and search this forum for answers but found nothing that can/will help.

Any ideas out there on how the get this laptop back among the living.

Any help would be greatly appreciated as none if the data on the laptop has been backed up.

Cheers in advance for suggestions

Francis

Speedy Gonzales
04-11-2007, 05:30 PM
Sounds like its not up to date with updates.

And it got hit.

I would somehow connect it to a working computer (take the hdd out, you may need an adapter to connect it to a desktop).

And scan it with a virus scanner.

Then copy what u want to a desktop (besides programs that have been installed already), then put it back in the laptop, then use the restore cd then format the hdd again.

The only other option would be, is to find that restore cd, and reinstall the OS.

Only thing is, if u use the restore cd's/dvd, it'll format the hdd.

Update it to SP1 or 2 BEFORE it gets on the net (If it was connected to the internet).

wainuitech
04-11-2007, 05:40 PM
Just before you do what Speedy suggests, -

If the lsass.exe is spelt with a capital L this is ok...if spelt all lower case this is a virus.

timaru2007
04-11-2007, 05:41 PM
I would somehow connect it to a working computer (take the hdd out, you may need an adapter to connect it to a desktop).

And scan it with a virus scanner.

The only other option would be, is to find that restore cd, and reinstall the OS.

Only thing is, if u use the restore cd's/dvd, it'll format the hdd.

Hi
thanks for the speedy reply. The restore CD has been found and is making its way here. I gather that this will make her lose all the documents she has stored on the HDD??

Am personally quite keen to take HDD out. What kind of connector would I need to connect to another PC. Would Dick Smith have a part like that?
Have both a laptop and desktop at home to connect the HDD to.

Thanks

Francis

Speedy Gonzales
04-11-2007, 05:47 PM
Something like this ? (http://www.dse.co.nz/cgi-bin/dse.storefront/472d5586011d9c362740c0a87f330688/Product/View/XH6905)

I think the hdd would be 2.5 ?

I would get this adapter, and connect it,(and copy the docs etc u want off it), BEFORE you use that restore cd.

Or else once it formats, EVERYTHING is gone. You wont be getting anything on this hdd.

Make sure you have some kind of virus scanner on the desktop.

BEFORE you copy whatever documents to it (create a folder call it info or any name).

Just in case something is infected.

CYaBro
04-11-2007, 06:11 PM
I have repaired this error quite a few times using this (http://support.microsoft.com/kb/307545) if you can get it to accept a password (or just press enter for no password) at the recovery console.

wainuitech
04-11-2007, 06:32 PM
I have repaired this error quite a few times using this (http://support.microsoft.com/kb/307545) if you can get it to accept a password (or just press enter for no password) at the recovery console. Yep that works well if its a windows error, but as I put in Post #3 if its a virus it normally wont work. Its the good ol sasser virus, which is in the system32 folder and reinfects the moment the PC is rebooted.

Speedy Gonzales
04-11-2007, 06:42 PM
What about this ? (http://support.microsoft.com/kb/883268)

Only thing is it says Pro not Home.

timaru2007
04-11-2007, 06:58 PM
Just before you do what Speedy suggests, -

If the lsass.exe is spelt with a capital L this is ok...if spelt all lower case this is a virus.

It is all spellt in lowercase... So a virus!

Speedy Gonzales
04-11-2007, 07:04 PM
You sure about that WT??

The lsass file here is all lower case too, it definitely isnt a worm/virus.

timaru2007
04-11-2007, 07:04 PM
What about this ? (http://support.microsoft.com/kb/883268)

Only thing is it says Pro not Home.

HAd a look at that but requires access to "Safe mode with command prompt" or "last known good configuration". Both of these I cannot get into.

Resigned myself at this stage to try and copy data off the HDD using drive adaptor and then using the recovery CD. Will have to wait till tomorrow though. Getting tired now...

Cheers
Francis

Speedy Gonzales
04-11-2007, 07:12 PM
Another thing you could do, is get the adapter connect the laptop hdd, and copy lsass.exe from the desktop to C:\windows\system32 folder on the laptop.

Then scan the laptop hdd first for viruses etc. Once its clean, put it back in the laptop. See if it boots

Was SP1 or 2 on this laptop??

timaru2007
04-11-2007, 07:44 PM
Another thing you could do, is get the adapter connect the laptop hdd, and copy lsass.exe from the desktop to C:\windows\system32 folder on the laptop.

Then scan the laptop hdd first for viruses etc. Once its clean, put it back in the laptop. See if it boots

Was SP1 or 2 on this laptop??

Thanks

I'll give that a try.

No idea whether SP1 or SP2 are on this laptop. Sis in Law is not very computer savvy, although she types really fast! Will need to spend some time updating it when all's running again.

Cheers
Francis

supergran
05-11-2007, 01:50 PM
The lsass file here is all lower case too, and I definitely don't have a worm/virus. Touch Wood

wainuitech
05-11-2007, 02:49 PM
You sure about that WT??

The lsass file here is all lower case too, it definitely isnt a worm/virus.
Just went back and checked some notes, as it seems there is conflicting reports, some say the Lower case l is a virus, some say the L is and some say the i is. Even the AV companies all spell it differently some all in caps some in lower case.

Since the sasser had many different variants its all confusing, any how if the reg rebuild doesnt work (its time consuming I've done it a few times) with a 50/50 success rate - then generally a wipe the drive and load windows again is the best choice (after saving data of course)

The reg fix appears to also be dangerous with an OEM install

Warning Do not use the procedure that is described in this article if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives. From Microsoft Support (http://support.microsoft.com/default.aspx?scid=kb;en-us;Q307545) Same article posted earler on.

timaru2007
15-11-2007, 07:58 PM
Thanks all

removed HDD from laptop and recovered all the documents.

Used restore CD (4) and reinstalled everything. Partitioned drive so Docs are now seperated from OS.

Thanks for the advice

Francis

drcspy
16-11-2007, 02:49 AM
We are still trying to find the original restore disc, but have tried an old copy of XP home I have lying around to see if a repair is possible.
It is not as I am asked for an administrator password. When this is entered it tells me I used the wrong password.

ok firstly it's good to see you fixed it ......however i'm curious.......when it asked you for an administrator password the default is usually to simply tap 'enter' as the password is usually really non existant did you try that.....also by asking for an admim password it's pretty obvious you were trying to access the 'recovery console' that's NOT how you run a 'repair install' you dont 'tap R to repair' the comp at the first choices screen you tap enter as if you are goin to reinstall the operating system. That then takes you to a screen where the install process will recognise your existing system and offer to repair it.......that essentially is a re-install 'over the top' of the existing system and it's 'non destructive' thus you dont lose any data/programs/settings etc.........however theres a catch......usually with laptops they're a VLK (volume liscense key) and if you try that process you'll end up at a point where you try to input what you believe to be the windows liscense key which you'll usually find on the bottom of the laptop however it'll jsut keep telling you 'not a valid key' .........problem ! so your best solution was and is to use the genuine restore cd set assuming you can find one which you did.......

there; a little info for you