Lsass

[Thomas Wendell]

My sister just called with a problem:
When she starts her machine, starts up to the moment the welcome screen
should come. Then it shows a box (I guess, she couldn't describe it very
well) with the words "LSASS.EXE - System Error, The specified handle is
invalid" and OK button. But nothing happens when pressing this. So none of
the 5 created users can log in (the Admin password they've forgotten). Safe
mode works, Last Known Good gives the same error

OS is XPpro_FI, OEM and SP1 (my install, unless they've since updated to
SP2)

Any ideas?? I'm going there on Saturday, so I'd rather have something
remedies with me
--
Tumppi
Reply to group
=================================================
Most learned on nntp://news.mircosoft.com
Helsinki, Finland (remove _NOSPAM)
(translations from FI/SE not always accurate)
=================================================

 

[Frank Saunders, MS-MVP]

My sister just called with a problem:
When she starts her machine, starts up to the moment the welcome
screen should come. Then it shows a box (I guess, she couldn't
describe it very well) with the words "LSASS.EXE - System Error, The
specified handle is invalid" and OK button. But nothing happens when
pressing this. So none of the 5 created users can log in (the Admin
password they've forgotten). Safe mode works, Last Known Good gives
the same error

OS is XPpro_FI, OEM and SP1 (my install, unless they've since updated
to SP2)

Any ideas?? I'm going there on Saturday, so I'd rather have something
remedies with me

What You Should Know About the Sasser Worm and Its Variants
http://www.microsoft.com/security/incident/sasser.mspx

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[John Barnett MVP]

Possibly a virus. The Sasser worm. Make sure you virus check the system. I
hope your sister had anti virus software on her system? If not get the free
version of AVG anti virus from www.grisoft.com . You might also like to look
at the threads in the link below
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_20985875.html (if
the link doesn't work from within the newsgroup copy and paste the whole
link into your web browser)

 

[Thomas Wendell]

Thanks to both, I also suspect Sasser.. (They don't confess to installing
anything, only making a bid on a local "e-Bay" (huuto.net)? That needed some
poking on the machine, I understand)

I have AVG, so I can take that with me, but on what? As I can access only
SafeMode, can I take it on external USB disk or do I have to burn it to
CD-RW?? I mean, does a SafeMode include USB- and UDF-drivers? And from a
limited account??


If I can get the system running normally, I'm thinking of creating myself on
that machine as admin (as backup to the normal one), but can I hide my
account from the welcome screen??

--
Tumppi
Reply to group
=================================================
Most learned on nntp://news.mircosoft.com
Helsinki, Finland (remove _NOSPAM)
(translations from FI/SE not always accurate)
=================================================

 

[Thomas Wendell]

Also, the system was up date re. Windows updates, at least as of Oct
23rd,.2004

Can I run AVG without installing it?

--
Tumppi
Reply to group
=================================================
Most learned on nntp://news.mircosoft.com
Helsinki, Finland (remove _NOSPAM)
(translations from FI/SE not always accurate)
=================================================

 

[John Barnett MVP]

Safe mode won't recognise USB or UDF drives but you should be able to make a
set of emergency floppy disks for AVG. I'm currently running Avast on my
system so i can't go through the instructions. i know when you first install
AVG you have an option to create the emergency floppy disks. Have a nose
around your AVG application and see if you can create a set of disks to
carry with you. Another alternative i was going to suggest, but you can't
access the desktop, was McAfee Stinger (free)
http://vil.nai.com/vil/stinger/ This is a stand alone product which works
from the desktop. It isn't an anti virus application it is just a quick fix
for the most notable viruses and worm that can be used for infected systems.
I can't find anything on the web site about adding it to a bootable floppy
but it is only 912kb so it would fit on a floppy.T