Sasser\lsass.exe not allowing login.

[Jim]

Greetings. My place of employment has a 2000 machine that is getting
a 2 part error message. The first is "The Procedure entry point
ElfFlushEventLog could not be located in the dynamic link library
ADVAPI32.DLL". If you click OK, you get the "lsass.exe terminated
unexpectedly with status code 128" error and the 1 minute countdown to
reboot. I can not get past this to apply the patch.

Same thing when trying to get through safemode.

A co-worker was able to access the machine using erd commander. We
found no trace of the sasser worm. But are still unable to log into
the machine. We get the error every time it boots.

I should count myself lucky that it's only one machine that was missed
out of 800+, but it's still ruining my day.

Many thanks.

 

[Jim]

The machine does not allow any input past the clicking of OK in the
first error message. It boots, but before it gets to the CNTR-ALT-DEL
screen it chokes and reboots. It's looking like another rebuild now.

 

[Steven L Umbach]

I don't know if it would help, but try safe mode. --- Steve

 

[Jim]

Wouldn't go in, even in safe mode. I ended up pulling the machine off
line and am doing a complete rebuild on it. Thanks to all who threw
in on my question. -Jim