Windows XP services.exe / lsass.exe application failed to initialize boot error

[Bob Thompson]

Are these the correct file sizes and dates for Windows XP corporate?

C:\> dir C:\WINDOWS\system32\lsass.exe
08/03/04 12:26p -a------ 13312 bytes lsass.exe
C:\> dir C:\WINDOWS\system32\services.exe
08/03/04 12:26p -a------ 108032 bytes services.exe

The reason I ask is I am currently in the Windows Recovery Console
trying to figure out why a newly installed Windows XP PC won't boot
normally, won't boot in the "Last known good configuration", won't boot
in "Safe Mode", etc.

In every case, what happens after the Windows logo goes away are these
five steps.

1. This message pops up:
services.exe - Application Error
The application failed to initialize properly (0xc0000006).
Click on OK to terminate the application.

To which the mouse works fine to click on the OK button.

2. Then this message pops up:
lsass.exe - Application Error
The application failed to initialize properly (0xc0000006).
Click on OK to terminate the application.

Again, the mouse works just fine as I click on the OK button.

3. Then the "Services" message in #1 pops up again.

4. Then the "Local Security Authority Subsystem Service" message in #2
pops up again.

5. Then the screen goes to a black screen yet the mouse cursor still
works.

Nothing else seems to work (not even control + alt + del).

If we boot to Safe Mode, the screen is black except for the mouse and
the typical safe-mode words at the top and bottom. If we boot in normal
mode, the screen is wholly black save for the mouse cursor which works
just fine although nothing happens no matter what button we click.

There is almost no chance that a virus occurred as this machine is
inside a strong firewall (however, the possibility exists, however
remote).

The wierdest thing though, is that booting to the Windows Recovery
Console and running the dos dir commands below give what appear to be
"normal" file sizes and dates.

Do these file sizes and dates look reasonable to you?
C:\> dir C:\WINDOWS\system32\lsass.exe
08/03/04 12:26p -a------ 13312 bytes lsass.exe
C:\> dir C:\WINDOWS\system32\services.exe
08/03/04 12:26p -a------ 108032 bytes services.exe

 

[ANONYMOUS]

The files on my system are:

04/08/2004 12:00 13,312 lsass.exe
04/08/2004 12:00 108,032 services.exe

I am using SP2 version. *Not* SP0 or SP1 and then patched up with SP2

If you have just installed the OS then why not try again to do a clean
install by following the guidelines given here:

http://www.michaelstevenstech.com/cleanxpinstall.html

hth

 

[R. C. White]

Hi, Bob.

As ANONYMOUS says, if this is "a newly installed Windows XP PC", why not
just reformat, then boot from the CD-ROM and clean install it again? You
would probably be up and running in less than an hour.

Those two files in my system are the same sizes as yours. The only
differences are in the time stamps. Mine are both dated 08/04/2004, 6:00
AM. (Since I'm running the US version, 08/04 means August 4, not April 8.)

There's no such thing as "Windows XP corporate". There are Windows XP
Professional and Windows XP Home Edition. I assume you mean WinXP Pro, but
it doesn't really matter; they are identical except for some network and
security features that should not matter here.

Well, there is the 64-bit edition, called WinXP Pro x64. Those two files in
my copy of x64 are 14,336 and 221,696 bytes and both are dated 03/25/2005 at
6:00 AM. And there was the XP64 (not x64) version, too, but that was only
for Itanium CPUs and has now been discontinued.

Have you run a good memory test on that computer?

RC

 

[Bob Thompson]

Why not just reformat, then boot from the CD-ROM and clean install again?
There's no such thing as "Windows XP corporate".
Have you run a good memory test on that computer?

I had had lsass.exe & services.exe failing to initialize before so I
didn't know if it was a well known and easily fixed problem. (Plus the
fact that it happens twice every time intrigued me as to why.)

Nonetheless, I am now up & running, after duly following R.C. White's &
anonymous's suggestion (btw,
wwww.michaelstevenstech.com/cleanxpinstall.html is awesome!). I feel I
"cheated" by choosing to blindly "repair" WinXP by reinstalling.
Somehow it seems "wrong" to not identify the "real" problem but your
time and my time is of the essence so sometimes a short generic cheat
fits the situation.

I thank you very much for your advice as I really wasn't sure how to
proceed. Your advice will help all others who follow in our footsteps.
For the record, I wasn't the one who installed the "bad" Windows XP
pro. My IT tech was the one who installed it for me - her WinXP pro
install worked for a few hours but then crashed on me just as I was
running my newly installed PC Magazine's InCtrl5 program to take a
system snapshot. (Maybe that corrupted something???). Since I REALLY
needed my PC, I borrowed her corporate license Windows XP Pro CDROM on
my way out the building after I saw your post and did the recovery
reinstallation before I went to bed last night.

I should note I wasn't really sure what I was doing as I couldn't "join
the domain" without a special domain administrator password. At the
moment, I see only two new "problems".

1. I seem to be able to log in to the domain this morning using a login
of "DOMAIN\login" instead of "login". This might be related to the fact
I couldn't "join" a domain last night on my standalone system I brought
home because I didn't have the domain administrator password and I
wasn't anywhere near the corporate network.

2. And while most applications work just fine, all the Microsoft Office
2003 tools fail with "Application Error. The application failed to
initialize properly (0xc0150002). Click on OK to terminate the
application". I plan on resolving this error the same way as the
lsass.exe & service.exe failure - I'll ask my IT tech for her MS Office
2003 installation CDROM & re-install myself.

For the record, I STILl don't know "why" lsass.exe & services.exe
failed to initialize (your file sizes and dates are very similar to
mine so I do not think the actual files were corrupted). Something else
caused the problem but I can now learn more about what a service
initializing means at my leisure rather than in an emergency mode.

Thank you both for your help and I hope the many who read this benefit
too!
B. Thompson

PS. I have no idea how to run a memory test but this particular laptop
has the original 2-year old memory cards so I will look for a good
memory tester if there is a freebie one out there somewhere.

PSS. It's windowx xp pro. The "corporate" turns out to be the license
for the CDROM, not the software. Thank you for clarifying that (I just
asked my IT tech and that's what she said.)

 

[Bob Thompson]

I had had lsass.exe & services.exe failing to initialize before so I
didn't know if it was a well known and easily fixed problem. (Plus the
fact that it happens twice every time intrigued me as to why.)

Ooooops. I "never" had lsass.exe & services fail to initialize before!

(sorry for the typo).

 

[Bob Thompson]

Update:

Most applications work fine but when I print from Outlook 2003, I now
get:
"Microsoft Outlook: The messaging interface has returned an unknown
error.
If the problem persists, restart Outlook".

I get this every time so I think I'll install the service pack 1 update
to Microsoft Office.

If that doesn't work ... I guess I'll start learning about the
"messaging interface" (whatever that is).

B. Thompson

 

[R. C. White]

Hi, Bob.

Ain't computers FUN? ;^}

But it's obvious that you are making progress. Now you've graduated from a
WinXP problem to an Office/Outlook problem. You'll have better luck with
your Outlook questions in an Outlook-specific newsgroup, rather than this
WinXP General group. You might start in this one:
microsoft.public.outlook.installation

Those groups are where the Office and Outlook gurus hang out.

RC

 

[Bob Thompson]

Now you've graduated from a WinXP problem to an Office/Outlook problem.

UPDATE:
I solved the Microsoft Office error "Microsoft Outlook: The messaging
interface has returned an unknown error. If the problem persists,
restart Outlook".

For others to successfully follow if they get the same error, my
googling found the problem was NOT the software but something called a
"profile" (so I wasted my time re-installing "Microsoft Office 2003
with FrontPage & Access".

What worked was deletion of my Default Outlook Profile (whatever that
is) by the procedure below:

I killed Microsoft Outlook and all Microsoft Office running
applications.
I clicked Start, and pointed to Settings, and then clicked Control
Panel.
I double-clicked the Mail icon in the Control Panel.
I clicked on Show Profiles.
There was only one profile so I clicked on the "Default Outlook
Profile".
Then I clicked on the "Remove" button.
Voila.

When I reestarted Outlook, it asked for me to create a new profile.
I wasn't even sure WHAT a profile is (as I get my mail using POP3
Thunderbird.
But, I answered all the questions as best I could (what the hell is an
Exchange Server) and now all my Office applications are finally happy.

Whew! You learn nothing if you let IT have all the fun fixing your
computer but you do get to learn all about frustration!

Bob T.

 

[Guest]

Along the same line - I get the same lsass.exe application error at boot up
and the same symptoms. I've run the Recovery Console chkdsk /r and it said
it found and fixed errors (but don't know what), makes no difference, problem
still exists. Running XP SP2 on a Dell Dimension 4500. QUESTION - if I do a
repair installation will I lose data and will I have to reinstall my apps, or
will everything still be there??

Thanks for any insight,

Kim

 

[R. C. White]

Hi, Kim.

I'm always wary of Replies that piggyback on an existing thread and start
out with something like, "I get the same...error..." Your case, like so
many others, does not sound as similar to Bob's as you think. For instance,
where in Bob's messages does he ever mention Dell?

Did your WinXP come pre-installed on your Dell? Did you get a full WinXP
CD-ROM with it? Or only a Recovery Disk? If you don't have the full system
CD then you probably won't be able to do a repair install. An OEM version
of WinXP is supported by the Original Equipment Manufacturer (Dell), NOT by
Microsoft. Your first call should be to Dell.

But, if you CAN do a repair install, it will reinstall WinXP completely, but
preserve your installed applications and data. See KB article 315341 and
the page by MVP Michael Stevens that Anonymous mentioned several messages
ago: http://www.michaelstevenstech.com/cleanxpinstall.html

I've never had a Dell, but my understanding is that use of the recovery
disk(s) will restore your computer to the as-new condition. In other words,
you will lose everything you've put on it since you bought it. :>(

In addition to Dell Tech Support, you might like to try the Usenet newsgroup
alt.sys.pc-clone.dell. That's the peer-to-peer support group for Dell users
and there are some very knowledgeable Dell gurus there.

If you need more help from these Microsoft groups, please start a new thread
and describe your symptoms in some detail. Be sure to include the basic
description of your computer, and mention that it is a Dell Dimension 4500.

RC

 

[AlexFR]

How to fix this? "servises.exe - Application Error

How to fix this? anybody knows if this Is a new Virus,trojan behavior or just my windows xp is corrupt?


Hi there,
This Application Errors happen when I was working so I restart my pc and now...


Every time I boot my computer with Windows XP MC I get no taskbar no icons sometimes is black screen, sometimes appears my wallpaper only and always I get first this error message: "servises.exe - Application Error: The instruction at '0x0037149c' referenced memory at '0x0113a170'. The memory cold not be 'read'.". The error dialog box gives me the options 'OK' to terminate and 'Cancel to debug'. But by selecting either one system keep bring another similar application errors like Isass.exe, svchost.exe, SAS window:winlogon.exe,logonui.exe,drwtsn32.exe, sometiimes again logonui.exe but the difference is the memory could no be readen and reboot alone The instruction address is always the same and the memory address is same for all application errors at each boot. This is happen even in the safe mode.
sometimes when taskmanager.exe application error appear then if I am lucky the ctrl alt del is working and shows the taskmanager so when I type to run : msconfig it shows in the process but did not appear in the screen and the same is happen when i try to run antivirus or other programs so I can't work on the computer
I've already tried the following to solve the problem:
Boot with the cd " Last XP '
- I've tried to restore a pervious windows registry: restore it but with No success because the same problem remain .
- Dr Web cure it found backdoor IRC.nite.18 and clean it: but with restart still getting the error messages.now no infections or spyware found.
- Tested the hard disk all ok
- Tested the memory with three passes of the Memtest86 tool: Memory is OK.

There is the same error messages if I boot the computer in Safe Mode

Boot with Avast bart CD and the virus scan It shows
7 win32: rootkit-gen rtk
8 win32: trojan -gen (com infector & exe infector)
3 win32: oliga (trj)other
2 mw97: itablebroken (expi)
3 win32: Hupigon-LXL(trj)
It removes all except 1 the win32:fujack-K wrm in pagefile.sys So I delete the file manually again scan nothing but in my reboot the same problem exist.

Put my hard disk slave in a friend pc and run his antivirus it
found 2 dropped:adware:agent LX and deletion failed in the infected dbplugin.ocx Delete the file manually, rescan clear, reboot the same problem

my hard disk full of programs and data ..except format.. Any suggestion?

 

[AlexFR]

Can you help me?

 

[AlexFR]

Hello

Is Anybody Home?

Anyway if someone want to help me here is the message in the bottle:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:45:37 μμ, on 15/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\regedit.exe
C:\Program Files\Uniblue\ProcessScanner\ProcessScanner.exe
C:\WINDOWS\system32\dwwin.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www-proxy.spidernet.net:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.*.*;www.i-choice.com.cy;www.spideradsl.com;*.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVGOA1~1\TVGOA1~1\TVTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\Sousana\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-2052111302-1844823847-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-2052111302-1844823847-725345543-1003\..\Run: [µTorrent] "C:\Documents and Settings\Sousana\Desktop\utorrent.exe" (User '?')
O4 - HKUS\S-1-5-21-2052111302-1844823847-725345543-1003\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193069427790
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://81.186.166.196/activex/AMC.cab
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NBService NBServicedmadmin (NBServicedmadmin) - Unknown owner - C:\WINDOWS\system32\wpv1980.cpx.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE

--
End of file - 5954 bytes