winlogon.exe,service.exe,lsass.exe - Bad Image

[Guest]

Oh Wise Ones,

I get these after I try to reboot. I was running several apps today and my
system locked up. I had to reset. Upon bootup I was taken to chkdsk.
Yesterday Executive Diskeeper alerted me to a potential problem on my C drive
and would run chkdsk when restarted. Well this was the restart and chkdsk
went though what appeared to be several hundred repair steps. After that it
rebooted and I get these three error messages in succession after the logo
appears (according to MSKB this is real bad and boot disks won't work). My
recovery console boots to c drive but will not recognize commands such as cd
\. So what can I do? Are there bootable third party disks that can access
and repair the c drive? I can get to my other drives with the recovery
console, just not my boot drive c.

Mike

 

[Guest]

Oh Wise Ones,

I get these after I try to reboot. I was running several apps today and my
system locked up. I had to reset. Upon bootup I was taken to chkdsk.
Yesterday Executive Diskeeper alerted me to a potential problem on my C drive
and would run chkdsk when restarted. Well this was the restart and chkdsk
went though what appeared to be several hundred repair steps. After that it
rebooted and I get these three error messages in succession after the logo
appears (according to MSKB this is real bad and boot disks won't work). My
recovery console boots to c drive but will not recognize commands such as cd
\. So what can I do? Are there bootable third party disks that can access
and repair the c drive? I can get to my other drives with the recovery
console, just not my boot drive c.

Hi Mike,
Your computer is infected with viruses and malwares.
First try to login Safe mode and Open Internet connection then go to these
online scan sites and scan your computer:
http://www.pandasoftware.com/activescan
http://www.trendmicro.com
Then downnload these program for Anti-spyware:
http://www.lavasoftusa.com
http://www.safer-networking.org for spybot S&D

Also try to run HijackThis and send the Report to one of the forums deal
with HijackThis log not here:
HijackThis v1.99.1
http://aumha.org/downloads/hijackthis.zip ; is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware.
Post your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7
= Also you can try System Restore to an Earlier date before thisng gone bad.
HTH.
Please report back your findings.
Regards,
nass

 

[Guest]

It won't boot up. Right after the first logo screen, it goes black then
starts displaying the error messages in succesion. After they clear it
reboots and starts the whole loop over again. I need some kind of boot disk
option. I booted with a norton disk and the master boot record is clean.

Mike

 

[Guest]

Nass,

I forgot to add that the same thing happens with any boot option, safemode
or normal.

Mike

 

[Guest]

Hi Mike,
1= If you were receiving that many alerts about a problem as you described
with
regard to checking your hard drive, the first thing you need to do is to
check the hard drive manufacturer's website for their diagnostic tools as
the chkdsk function cannot determine hard drive failure or impending
failure. Make note of the instructions at the manufacturer's website for
creating the diagnostic boot disk and the diagnostics to run to test the HDD.

2= Then, try to start the computer with your CD and start the procedure of
installing, when you got the Setup window options select Set up, there you
will have the set up options select install, on the new window you will get
the chance of Installing on an exsiting Partition or Repair select (R) Repair.

3= Try to hook this machine to another machine having the same system and do
a Scan, because your system is infected, why?, because the path you provided
isn't Right:
" winlogon.exe,*service.exe*,lsass.exe - Bad Image"
*service.exe* should be services.exe
Also if you got through (the HDD not dead) try to rescue the Data,you may
end up doing a clean installation on this machine.

4= If the Reinstall/Repair did not resolve the issue, try the to
repair/Rebuild the boot.ini by start in SRC (System Recovery Console) and do
this:
You can always write ? to show all commands available to you on the prompt
command
C:\>?

COPY D:\i386\ntldr c:\
COPY D:\i386\netdetect.com c:\ where D (your CD Letter for ex)

ATTRIB -H -R -S C:\boot.ini
DEL C:\boot.ini
BootCFG /Rebuild

P.S is this machine installed from Image?.

HTH.
Please let us know.
Regards,
nass

 

[Guest]

Nass,

Thanks for the response. I have done some things below:

Hi Mike,
1= If you were receiving that many alerts about a problem as you described
with
regard to checking your hard drive, the first thing you need to do is to
check the hard drive manufacturer's website for their diagnostic tools as
the chkdsk function cannot determine hard drive failure or impending
failure. Make note of the instructions at the manufacturer's website for
creating the diagnostic boot disk and the diagnostics to run to test the HDD.

I ran the diagnostic off of a bunrt iso from Western Digitals website. The
quick and extented tests show NO hard drive errors on my C drive.

2= Then, try to start the computer with your CD and start the procedure of
installing, when you got the Setup window options select Set up, there you
will have the set up options select install, on the new window you will get
the chance of Installing on an exsiting Partition or Repair select (R) Repair.

Setup wants to reformat the drive because the partition is too damaged.
Unless I can use some recovery tools to extract a few data files after a
reformat, I would rather not do this.

3= Try to hook this machine to another machine having the same system and do
a Scan, because your system is infected, why?, because the path you provided
isn't Right:
" winlogon.exe,*service.exe*,lsass.exe - Bad Image"
*service.exe* should be services.exe
Also if you got through (the HDD not dead) try to rescue the Data,you may
end up doing a clean installation on this machine.

Now I cannot get past the Verifing DMI pool dialog, it just hangs. So I
can't doublecheck and be absolutely sure it is "service" and not "services".
I have an extra HD sitting around I could put my OS on. I run Spyware Doctor
and Norton AV in protection mode, so a virus wasn't my first guess.

4= If the Reinstall/Repair did not resolve the issue, try the to
repair/Rebuild the boot.ini by start in SRC (System Recovery Console) and do
this:
You can always write ? to show all commands available to you on the prompt
command
C:\>?

COPY D:\i386\ntldr c:\
COPY D:\i386\netdetect.com c:\ where D (your CD Letter for ex)

ATTRIB -H -R -S C:\boot.ini
DEL C:\boot.ini
BootCFG /Rebuild

I can't do a DIR on the C drive. I tried the first step of the ini rebuild
and I recieved and error "The file could not be copied". I can do a cd C:
and get to the C prompt, but a dir read attempt gives me "An error occurred
during directory enumeration" . I can look at the help commands from the c
drive C:\>COPY /? but the file will not copy.

P.S is this machine installed from Image?

This is from an XP Pro OEM disk that I purchased with another hard drive a
few years back. I have re-installed several times through the years for a
number of reasons- new pc, corruption, system bogged down from several apps
installed. Things I consider pretty normal. I last re-installed about 4 mos
ago, then took all the updates to get to SP2 and current updates. My recovery
disk is 3-4 years old if it makes a difference.

Mike

 

[Guest]

Nass,

Thanks for the response. I have done some things below:



I ran the diagnostic off of a bunrt iso from Western Digitals website. The
quick and extented tests show NO hard drive errors on my C drive.


Setup wants to reformat the drive because the partition is too damaged.
Unless I can use some recovery tools to extract a few data files after a
reformat, I would rather not do this.


Now I cannot get past the Verifing DMI pool dialog, it just hangs. So I
can't doublecheck and be absolutely sure it is "service" and not "services".
I have an extra HD sitting around I could put my OS on. I run Spyware Doctor
and Norton AV in protection mode, so a virus wasn't my first guess.


I can't do a DIR on the C drive. I tried the first step of the ini rebuild
and I recieved and error "The file could not be copied". I can do a cd C:
and get to the C prompt, but a dir read attempt gives me "An error occurred
during directory enumeration" . I can look at the help commands from the c
drive C:\>COPY /? but the file will not copy.


This is from an XP Pro OEM disk that I purchased with another hard drive a
few years back. I have re-installed several times through the years for a
number of reasons- new pc, corruption, system bogged down from several apps
installed. Things I consider pretty normal. I last re-installed about 4 mos
ago, then took all the updates to get to SP2 and current updates. My recovery
disk is 3-4 years old if it makes a difference.

Mike

Hi Mike,
I did have similar Scenario a while ago but with the hal.dll was missing,
tried all and every thing in the book and out of the book to no avail.
The bottom line is even if it started, for how long it will last/stay
working, the best is if you have a valuable Data try to install the OS on
another HDD and Hook this HDD as a * Slave* and retrive your Data.
I realy can't see any good of making it work other than get Data out of it.
HTH.
Sorry if my sleeves run out of tricks. <grin>
Best of luck.
Regards,
nass

 

[Duffer]

Nass,
I have already pulled the drive and am installing the OS on
a new drive. Hopefully I can retrieve some files later.
thanks so much for your help

Mike