lsass.exe System error

[Guest]

Recently a computer I am servicing gave following error; "any I/O operation
initiated by the registry failed unrecoverable. The registry could not read
in, write out, or flush, one of the files that contain the system's image of
the registry." The computer then goes into reboot. Researching MS
information I learned it MAY be a virus. I low level formatted the hard
drive, purged CMOS, high level the drive and re-installed windows xp with
SP/2. It comes up with same error and constantly reboots. Will stay up in
safe-mode.
In running MS Article ID # 883268 I find my KDCSVC is not installed.

Any assistance??

 

[David H. Lipman]

From: "Larry6" <[email protected]>

| Recently a computer I am servicing gave following error; "any I/O operation
| initiated by the registry failed unrecoverable. The registry could not read
| in, write out, or flush, one of the files that contain the system's image of
| the registry." The computer then goes into reboot. Researching MS
| information I learned it MAY be a virus. I low level formatted the hard
| drive, purged CMOS, high level the drive and re-installed windows xp with
| SP/2. It comes up with same error and constantly reboots. Will stay up in
| safe-mode.
| In running MS Article ID # 883268 I find my KDCSVC is not installed.
|
| Any assistance??

To determine if it is a virus and not hardware or software, you need to indicate if you get
a "NT AUTHORITY\SYSTEM" shutdown in 60 second type message and what the EXACT message
indicates caused the shutdown.

 

[Guest]

I received no other messages than the one listed. I would think the low
level format and CMOS purge would rule out a virus. However have no other
clue to the source of the problem. Have reinstalled windows x3. Does the KDC
not installed mean anything.
Thanks for the reply.

 

[David H. Lipman]

From: "Larry6" <[email protected]>

| I received no other messages than the one listed. I would think the low
| level format and CMOS purge would rule out a virus. However have no other
| clue to the source of the problem. Have reinstalled windows x3. Does the KDC
| not installed mean anything.
| Thanks for the reply.

CMS purge ? Won't do anything for viruses.
Low level format won't help with Boot Sector Infectors.

However, you haven't indicated viral activity and it is most likely a hardware problem.

 

[Guest]

Thanks Dave. Have been reading your other postings for other people. You
seem to know a lot that it isn't, but no answers as to what it is. Do you
truly NOT understand why a CMOS purge is necessary in a virus removal???
Thanks a lot>

 

[David H. Lipman]

From: "Larry6" <[email protected]>

| Thanks Dave. Have been reading your other postings for other people. You
| seem to know a lot that it isn't, but no answers as to what it is. Do you
| truly NOT understand why a CMOS purge is necessary in a virus removal???
| Thanks a lot>

Is that a trick question :?

The very few viruses that play with the CMOS will either corrupt it or erase it (e.g;
EXEbug and CMOS { yes that's the name of the memory resident virus, circa '98} ). Thus
causing an error upon POST. There is no virus that "infects" the CMOS RAM and will
subsequently infect or re-infect a clean-wiped PC. Going back into the BIOS of the PC will
certainly reset the corrupted or erased BIOS. So "purging" the BIOS is not an anti virus
step. As for Boot Sector infectors, they don't like NTFS but when resident on FATxx they
will spread to other bootable partitions.

Finally, since you could not indicate the following...
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819

You have no virus. Since a wipe of the system and reinstall of the OS exhibits the same
problem, it indicates a hardware problem (maybe a hardware driver ?).

 

[David H. Lipman]

From: "David H. Lipman" <[email protected]>


|
| Is that a trick question :?
|
| The very few viruses that play with the CMOS will either corrupt it or erase it (e.g;
| EXEbug and CMOS { yes that's the name of the memory resident virus, circa '98} ). Thus
| causing an error upon POST. There is no virus that "infects" the CMOS RAM and will
| subsequently infect or re-infect a clean-wiped PC. Going back into the BIOS of the PC
| will certainly reset the corrupted or erased BIOS. So "purging" the BIOS is not an anti
| virus step. As for Boot Sector infectors, they don't like NTFS but when resident on FATxx
| they will spread to other bootable partitions.
|
| Finally, since you could not indicate the following...
| NT AUTHORITY\SYSTEM
| 'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819
|
| You have no virus. Since a wipe of the system and reinstall of the OS exhibits the same
| problem, it indicates a hardware problem (maybe a hardware driver ?).
|

That should have been...

Going back into the BIOS of the PC will certainly reset the corrupted or erased CMOS. So
"purging" the CMOS is not an anti virus step.