lsass.exe system error object name not found

[Sharon]

Got this error yesterday on a windows xp sp2 system.
I have reinstalled another copy of windows onto the hard drive and tried the
following:
1) symantec removal tool for sasser virus
2) microsoft malicious software removal tool
3) sasser removal tool from sophos
4) online norton antivirus scan

none are finding anything but I am still getting the error in my original
windows installation.

I have now tried repairing the original windows installation but am now
stuck on windows preparing for installation 39 minutes to go with lsass.exe
system error objact name not found error message.

I know that I can go ahead using the second windows installtion and recover
my data files that way, but I would much rather rescue my original
installation if at all possible.

I can get to the recovery console but not sure what to do there!

Please does anyone have any ideas?
many thanks,
Sharon

 

[David H. Lipman]

From: "Sharon" <[email protected]>

| Got this error yesterday on a windows xp sp2 system.
| I have reinstalled another copy of windows onto the hard drive and tried the
| following:
| 1) symantec removal tool for sasser virus
| 2) microsoft malicious software removal tool
| 3) sasser removal tool from sophos
| 4) online norton antivirus scan
|
| none are finding anything but I am still getting the error in my original
| windows installation.
|
| I have now tried repairing the original windows installation but am now
| stuck on windows preparing for installation 39 minutes to go with lsass.exe
| system error objact name not found error message.
|
| I know that I can go ahead using the second windows installtion and recover
| my data files that way, but I would much rather rescue my original
| installation if at all possible.
|
| I can get to the recovery console but not sure what to do there!
|
| Please does anyone have any ideas?
| many thanks,
| Sharon
|

Yeah of course those Sasser removal tool didn't help. Just becuase you have an error with
the LSASS module doesn't automatically mean it is Sasser related.

There is only ONE error tht would mean an Internet worm is exploiting the LSASS module
vulnerability and "lsass.exe system error object name not found" isn't it !

The one that is, is...


NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819

or

NT AUTHORITY\SYSTEM
'c:\winnt\system32\lsass.exe' terminated unexpectedly with status code -1073741819

Additionally, the Sasser is pretty much dead. It has been replaced by various other BOTS
such as the AGOBot, SDBot, RBot and SpyBot to name a few.

 

[Guest]

SHARON! I got the same error on my XPSP2 Notebook! Word for word, as you
describe it, is exactly what I am experiencing. It's a bunch of crap in my
opinion. And the steps you used to troubleshoot? Same as me. I went as far
as to explain the issue in technical detail to a "technician" on HP's live
chat - his conclusion? Well he has "had first hand experience with my exact
issue." All that training and "technical" skill had him diagnosing my system
error as being the result of the W32@sasser worm infection. Hmmm...

It didn't seem like that to me, based on Symantec's technical description of
the worm; but I went ahead and installed a paralled OS, on same partition, in
different folder, and ran numerous Virus Tools.... JUST LIKE YOU! And
NothinG! I shouldn't be surprised. HP always takes the most obvious anwser
- they're no more assistance than search engine results list. The most
relevent, is the answer they give me.

Microsoft KB883268 describes in exact terms, the issue we are having. But,
I've performed the resolution steps point by point, to no result. Heck, I
even gone as far as to disable each process mentioned in that KB using the
Recovery Console. No difference. Better yet, with the Recovery COnsole I
physically deleted and replaced Lsass.exe, services.exe files with fresh
copies from XP installation CD, and that had no difference.

Worst of all... I too attempted a Repair Installation of the damaged OS, and
now I am stuck in the same infinite loop of "SETUP iS BEING RESTARTED" just
to have "OBJECT NAME NOT FOUND" follow.

IF Any skilled persons read this, with experience in C++ or COM+
functionality and knowledge with DLL import/export tables and dependencies-
skill I just do not have; please PLEASE give "Sharon" and I some brain
storming ideas to try. Our system error might be most associated with these
core processes. Nothing I've done has even the slightest effect on the way I
experience the error. No matter what files I've replaced w/ older ones, what
services I disable, how many times I've run CHKDSK /r, or how many times I
perform a Repair Installation - has the slightest effect on error. It's the
same every time: the LOGON PHASE is halted and a small dialog error box
titled "Lsass.exe system error" appears stating "Object name not found." The
desktop partially loads - that is just the wallpaper appears, but no icons or
taskbar (i.e. Explorer.exe does not load), and as soon as you click "OK" on
the error box, the system reboots. I mean, even enabling the Boot Logging
switch doesn't tell me shit. It's not a very informative log. Does anybody
know of a different log file that documents the logon phase in more detail?
Or even a debug log that would be written for LSASS.EXE or SERVICES.EXE
service errors?

Finally, frustration accumulating from performing dozens of troubleshooting
steps just to have no visable effect in the error led me yesterday to using
the Recovery Console to ****in actually DELETE the LSASS.EXE file in the
Windows folder and rebooting. .... FINALLY!! A visable change! Albeit
didn't help me any: Upon startup, that error didn't happen. Instead, a
mouse cursor and a black desktop are all that occurs. The pointer never
hangs, but the system never loads. But at least I found some way to have an
effect of the system error! After replacing the LSASS.EXE file, the system
starts, the error once again occurs, and I'm back to square 1.

Peace out,
Craiger in San Diego

 

[Guest]

I wish I could help but I'm here for the same reason, the same damn message
started on Feb.4th, when I hit OK or tried to X out, it would restart my
computer. So I just moved the box off to the side and logged on, when my
desktop came up, the message box appeared again, I moved it again and later
just X'd out the box, it went away and didn't appear again until the next log
on. It is frustrating not to be able to find the answer to ridding the
problem, hell I don't even know what the lsass.exe is or what it does, how's
that. Anyway I came here for answers and thought I'd chip in on what little I
know.