very puzzling!!

[p.mc]

Hi All (Machine specs below my sig)

I got a bsod OXOOOOOOOA. (soft or hardware related) Anyhow event viewer
recommended checking C:\ for disk errors, which I did. But no joy,also with
xp disc. So I did last known good configuration at boot. And upon booting
and getting to welcome screen,a message stating;
"lsass.exe - system error - object name not found"
I read it could be a sasser worm and also maybe not. Also it does the same
in safe mode. Now to the point.

I DL Ultimate boot CD, which allows you to enter DOS with command prompt, to
which I copied "lsass.exe" onto floppy from another machine winxp home sp2
wereas my
faulty machine is winxp pro sp2 (hopefully they are the same, I believe the
"lsass" file has something to do with user logon!!)

And after the command prompt A:\ I added "copy lsass.exe
C:\windows\system32" even tried "move" instead of "copy" but to no avail.
This was in the hope that if that file was just corrupted, I could replace
it from floppy, boot up and do an intensive virus scan and hope fully the
bsod would go away also. I even DL sasser removal tool on floppy but I get
the same trouble trying to run that.

Does anyone have any experience using "ultimate boot cd"? That could give me
the path and instruction to run or replace a file?

I'd rather not reformat as some have and the same thing has happened.
Done a memtest
HDD diagnostics
Ram tests also and up to now they seem alright.

"3 solid days of hassle" :-((
--


Regards
p.mc

WinXP Pro inc Sp2
Intel C2Duo E6700 (2 x 2.66GHz) CPU
2048 MB CorsairXMS2 800MHz (2x1GB) RAM
ASUS P5N32-E SLI+ MOBO
768MB Gefrorce 8800 GTX Graphics card
Sound Blaster X-Fi PlatinumFatal1ty Sound Card

 

[Rich Barry]

You may want to try using the Recovery Console to copy that file.
Check here. You don't have to install it. Just boot off the CD and
choose Repair instead
of Install WinXP.
http://www.tweakxp.com/article36957.aspx

 

[p.mc]

Hi Rich

"Thanks for the reply"

I went into recovery console, and after the command prompt
"C:\WINDOWS" I added "COPY E:\ (E being my cd rom drive)1386\LSASS.EX
C:\WINDOWS\SYSTEM32"
as below without quotes
"C:\WINDOWS COPY E:\1386\LSASS.EX C:\WINDOWS\SYSTEM32"
But got "Access is denied"

If you noticed there was no "E" on the end of .EXE. That's how it was spelt
in the 1386 folder,but I added an "E" also, to no effect.

I'm going to put the LSASS.EX file onto a floppy tommorow and have the
command.
C:\WINDOWS COPY A:\LSASS.EX C:\WINDOWS\SYSTEM32
Hopefully that will do it...She who must be obeyed is lying doormant at the
moment and I dare not wake it.

"Nighty night"

 

[p.mc]

That didn't work either!! Anyone know what I'm doing wrong?

 

[Anteaus]

If it's named LSASS.EX_ then you need to do:

Expand LSASS.EX_ LSASS.EXE after copying to the hard-disk.

Expand.exe is also on the CD, in i386.

-Though, from the wording of the error, I suspect the problem may be lsass
choking-on bad data rather than being missing. This could well be the result
of an (attempted) virus attack as lsass is a common target.

 

[p.mc]

Hi Anteus

I too think it could be virus related, I was hoping that I could overwrite
the corrupted lsass.exe

 

[p.mc]

Hi Anteaus

I too suspect it's virus related, I was hoping I could overwrite the
lsass.exe file, using my OS disc and recovery console.
Could you elaborate a bit more on below? ("Don't quite get what you mean".)
"Newbie"

If it's named LSASS.EX_ then you need to do:

Expand LSASS.EX_ LSASS.EXE after copying to the hard-disk.

Expand.exe is also on the CD, in i386.

(This is where I'm stuck)
Copied LSASS.EX from my O/S disc to floppy, also have O/S disc in my E:\cd
drive.
At recovery console page it states;
C:\WINDOWS...and thenI need to know what to fill in next to copy from O/S
disc to C:\WINDOWS\SYSTEM32 or to copy from floppy to C:\WINDOWS\SYSTEM32

I have tried different wordage, but to no avail..ie
"C:\WINDOWS>CD E:\
There is no floppy or CD in the drive"

 

[Twayne]

Hi Rich

"Thanks for the reply"

I went into recovery console, and after the command prompt
"C:\WINDOWS" I added "COPY E:\ (E being my cd rom drive)1386\LSASS.EX
C:\WINDOWS\SYSTEM32"
as below without quotes
"C:\WINDOWS COPY E:\1386\LSASS.EX C:\WINDOWS\SYSTEM32"
But got "Access is denied"

If you noticed there was no "E" on the end of .EXE. That's how it was
spelt in the 1386 folder,but I added an "E" also, to no effect.

I'm going to put the LSASS.EX file onto a floppy tommorow and have the
command.
C:\WINDOWS COPY A:\LSASS.EX C:\WINDOWS\SYSTEM32
Hopefully that will do it...She who must be obeyed is lying doormant
at the moment and I dare not wake it.

"Nighty night"


Regards
p.mc

..ex_ means it's a compressed file that needs to be deflated, unzipped,
or expanded, whichever term you like. You need to use expand.exe on it.

If you've already invested 3 days on this, consider: Even a full
rebuild from scracth wouldn't take half that lone to have done. Don't
just reformat; start right from delete/create the partition/s you need.

--
--
Regards,

Twayne

Open Office isn't just for wimps anymore;
OOo is a GREAT MS Office replacement
www.openoffice.org

 

[Twayne]

That didn't work either!! Anyone know what I'm doing wrong?

With all the time you have invested, you're beating a dead horse. Toss
the original CD in the drive and boot from it. You'll be done in a few
hours; just be sure you have all your keycodes etc. handy beforehand.

Regards
p.mc

--
--
Regards,

Twayne

Open Office isn't just for wimps anymore;
OOo is a GREAT MS Office replacement
www.openoffice.org

 

[milleron]

.ex_ means it's a compressed file that needs to be deflated, unzipped,
or expanded, whichever term you like. You need to use expand.exe on it.

If you've already invested 3 days on this, consider: Even a full
rebuild from scracth wouldn't take half that lone to have done. Don't
just reformat; start right from delete/create the partition/s you need.

--

Let's just pause for a minute and take a deep breath. That's advice
you canNOT legitimately give without knowledge of OP's system. He may
have DATA on that C: drive that's not been backed up. You could be
advising him to just trash it. He may have a computer on which he's
installed literally hundreds of programs and useful utilities. You
cannot "rebuild from scratch" such a system in "half [of 3 days]." It
could take all his free time for weeks.

If this should be a virus, many commercial antivirus programs come
with a bootable rescue disk that hopefully can see both FAT32 and NTFS
partitions. That might be a valuable step to consider.

Also, UBCD4Win should come with some antivirus capability, perhaps
even one that can update itself after it's running, since UBCD4Win can
initialize and use NICs for Internet access. UBCD4Win might also
allow copying lsass.exe if it's corrupted, although I don't think we
have any evidence that it is. "Object name not found" does NOT mean
that lsass.exe is not found or corrupt. This is more likely the
Sasser worm. I'd get the MS Malicious Software Removal tool here
http://tinyurl.com/6bb67 and run it after booting with UBCD4Win. It
may be necessary to boot from the UBCD4Win CD, establish an Internet
connection with it, download the tool from MS, and run it from there.

Ron