G
Guest
I have two machines running XP home edition. I updated one to SP2 about a
month ago, saw that everything seemed okay, and so used the same file to
update the second machine. On the first reboot after installing SP2 on the
second machine, I got an error message right after the XP splash screen, but
before the user login screen. The error message was:
"lsass.exe - The data was too large to fit into the specified buffer"
Clicking "OK" on this error window initiates a cold boot, so I'm stuck in a
loop.
Booting to Safe Mode makes no difference. The same error message appears at
the same time.
Although this looks like a Sasser attack, I don't see how it could be. I've
been behind a hardware firewall for several years, with no virus or worm
problems. I patch at least once a month, and the Sasser patch is over 5
months old. I run Symantec virus protection, and their latest tool to
specifically remove Sasser code shows no virus on the disk (I moved the hard
drive to the "clean" machine for scanning). Finally, the error symptoms and
message are not common to any of the Sasser attacks I've read about.
I'd prefer not to reformat the drive. Any tips from the pros on this one?
month ago, saw that everything seemed okay, and so used the same file to
update the second machine. On the first reboot after installing SP2 on the
second machine, I got an error message right after the XP splash screen, but
before the user login screen. The error message was:
"lsass.exe - The data was too large to fit into the specified buffer"
Clicking "OK" on this error window initiates a cold boot, so I'm stuck in a
loop.
Booting to Safe Mode makes no difference. The same error message appears at
the same time.
Although this looks like a Sasser attack, I don't see how it could be. I've
been behind a hardware firewall for several years, with no virus or worm
problems. I patch at least once a month, and the Sasser patch is over 5
months old. I run Symantec virus protection, and their latest tool to
specifically remove Sasser code shows no virus on the disk (I moved the hard
drive to the "clean" machine for scanning). Finally, the error symptoms and
message are not common to any of the Sasser attacks I've read about.
I'd prefer not to reformat the drive. Any tips from the pros on this one?