Lsass.exe file deleted -- Now what?

G

Guest

I was infected with the Sasser worm without realizing it. I deleted the lsass.exe file. It is in the recycle bin. Now, I no longer get a login window. It won't even boot into Safe Mode or give me a command prompt. When I tried to run the Recovery Console, it wouldn't accept my administrator password. Is there anything I can do besides slaving the drive, backing up the files, and reformatting?
 
C

Carey Frisch [MVP]

How to Perform a Windows XP Repair Install
http://www.michaelstevenstech.com/XPrepairinstall.htm

If a "Repair Install" cannot be performed:

Clean Install Windows XP
http://www.michaelstevenstech.com/cleanxpinstall.html

[Courtesy of MS-MVP Michael Stevens]

What You Should Know About the Sasser Worm and Its Variants
http://www.microsoft.com/security/incident/sasser.asp

3 Steps to Help Ensure your PC is Protected
http://www.microsoft.com/security/protect/

Frequently Asked Questions About Antivirus Software
http://www.microsoft.com/security/protect/antivirus.asp

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------------------------------


|I was infected with the Sasser worm without realizing it. I deleted the lsass.exe file. It is in the recycle
bin. Now, I no longer get a login window. It won't even boot into Safe Mode or give me a command prompt. When
I tried to run the Recovery Console, it wouldn't accept my administrator password. Is there anything I can do
besides slaving the drive, backing up the files, and reformatting?
 
G

Guest

Thanks for the help..... but, I just found out there is another problem. I am not able to access the files in my user directory when I slave the drive. I get the message: Access is Denied. I can access the files in all of the other user directories located in the Documents and Settings folders, but not the ones I need to make a backup. After I do try the Repair install, will I be able to login to my user directory using my orginial password, etc.

----- Carey Frisch [MVP] wrote: ----

How to Perform a Windows XP Repair Instal
http://www.michaelstevenstech.com/XPrepairinstall.ht

If a "Repair Install" cannot be performed

Clean Install Windows X
http://www.michaelstevenstech.com/cleanxpinstall.htm

[Courtesy of MS-MVP Michael Stevens

What You Should Know About the Sasser Worm and Its Variant
http://www.microsoft.com/security/incident/sasser.as

3 Steps to Help Ensure your PC is Protecte
http://www.microsoft.com/security/protect

Frequently Asked Questions About Antivirus Softwar
http://www.microsoft.com/security/protect/antivirus.as

--
Carey Frisc
Microsoft MV
Windows XP - Shell/Use

Be Smart! Protect your PC
http://www.microsoft.com/security/protect

----------------------------------------------------------------------------------------------------


|I was infected with the Sasser worm without realizing it. I deleted the lsass.exe file. It is in the recycle
bin. Now, I no longer get a login window. It won't even boot into Safe Mode or give me a command prompt. When
I tried to run the Recovery Console, it wouldn't accept my administrator password. Is there anything I can do
besides slaving the drive, backing up the files, and reformatting?
 
C

Carey Frisch [MVP]

This article describes how to take ownership of a file or folder
to which you have been denied access:

How to Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308421&Product=winxp

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

------------------------------------------------------------------------------------------


| Thanks for the help..... but, I just found out there is another problem. I am not able to access the files
in my user directory when I slave the drive. I get the message: Access is Denied. I can access the files in
all of the other user directories located in the Documents and Settings folders, but not the ones I need to
make a backup. After I do try the Repair install, will I be able to login to my user directory using my
orginial password, etc.?
 
G

Guest

Thank you sooooo much! That worked great to access my files. At least I can back them up before I try doing the repair. Thanks again!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top