XP Home shows 'lsass.exe' message

[Philip Andrews]

Hi,

Can anyone help or advise me please?

Out of the blue, my Packard-Bell PC running on XP Home has started
showing a message window at boot time:

"lsass.exe - System Error"

(and underneatht that, in the same window)

"Object Name not found"


When I click the 'OK' button to clear that window, the PC pauses for
about a minute and then reboots itself, returning to the same point each
time. Clicking 'OK' produces another reboot. This happens both in Normal and
all Safe Modes: I can't get beyond that point.

The hard drive has been removed and run in another machine (wired up as
secondary slave), checked for viruses and spyware (using AVG 7.5 and
Ad-Aware 6.0), and was found to contain only tracking cookies. My best guess
is a possible Registry corruption, but I have no idea how it happened or how
to deal with it. Reloading the whole thing would be a possible option, but a
very aggravating one.

Help, please, all you kind and knowledgeable people!


Cheers,

Philip

 

[mattias.eklund]

I´m currently troubleshooting an Acer for the exact same problem. It
seems like something has messed up filenames and sizes in %windir%. As
soon as I get an answer from MS about this I´ll post it here.

 

[Ron Martell]

Hi,

Can anyone help or advise me please?

Out of the blue, my Packard-Bell PC running on XP Home has started
showing a message window at boot time:

"lsass.exe - System Error"

(and underneatht that, in the same window)

"Object Name not found"


When I click the 'OK' button to clear that window, the PC pauses for
about a minute and then reboots itself, returning to the same point each
time. Clicking 'OK' produces another reboot. This happens both in Normal and
all Safe Modes: I can't get beyond that point.

The hard drive has been removed and run in another machine (wired up as
secondary slave), checked for viruses and spyware (using AVG 7.5 and
Ad-Aware 6.0), and was found to contain only tracking cookies. My best guess
is a possible Registry corruption, but I have no idea how it happened or how
to deal with it. Reloading the whole thing would be a possible option, but a
very aggravating one.

Help, please, all you kind and knowledgeable people!

"There's a strong possibility that this is a virus, unfortunately. The
LSASS process manages user logins, and as such is a common target for
infections on PCs running various versions of Windows."

Get a second opinion regarding possible virus/spyware infestations by
putting the hard drive back into the other machine and scanning it
with at least one of the following free online scanners:
Bit Defender http://www.bitdefender.com/scan8/ie.html
Trend Micro http://housecall.trendmicro.com
Kaspersky Online Scanner http://www.kaspersky.com/virusscanner
Panda ActiveScan http://www.pandasoftware.com/activescan
WindowSecurity.com TrojanScan http://windowssecurity.com/trojanscan
Webroot http://www.webroot.com/

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2006)
On-Line Help Computer Service
http://onlinehelp.bc.ca
Syberfix Remote Computer Repair

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

 

[Philip Andrews]

Mattias, Ron -

Thanks to both of you for your messages of sympathy with this crappy
problem. The cause was found to be due to a nice new Trojan (weeded out
eventually by AVG7.5, running the P-B hard-drive in a dedicated test PC) -
but the Registry was still found to be corrupted and had to be fixed
separately.

So ... using MS's article 307545 as a guide, I forced a manual System
Restore by backing up and replacing the current (corrupt) Registry files
with copies of those from a Snapshot taken 2 days ago. I did this by file
substitution using the test PC (to get around all the risky typing in
Recovery Console, detailed in article 307545) after enabling the System
Volume Information folder(s) for full control, and the trick worked first go
(thank Providence).

Hope this helps you with the Acer laptop, Mattias - you might try
picking a likely Restore point from when the laptop definitely worked OK,
and then copy out/rename/apply the five replacement files that will make up
the new Registry. If the chosen restore point files fail to do the job,
simply go back a bit further and pick up five earlier files. Putting the
laptop hard-drive in a desktop PC (using a cable adaptor) will probably make
your task a lot easier. If you need email help, the address below now ends
with @aol.com instead of @tiscali.co.uk

Regards,

Philip