"lsass.exe: System error" every time I boot Windows?Dave, I am runnng Windows XP, I have performed system restore and now when I start up I get the error message, "lsass.exe. system error". in the box it says when trying to update this return status indicates that the value provided as the current password is not correct. It then closes down and starts up again and I get the message and it will not start up!! it keeps going round and round. It does the same in safe mode. I have tried to press f8 and install windows from the discs but this does not work. My XP is on a partition. I have no floppy drive on my other pc. What do I do?? There's a strong possibility that this is a virus, unfortunately. The LSASS process manages user logins, and as such is a common target for infections on PCs running various versions of Windows. Here's a description of this virus from Trend Micro: "This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system. To propagate, it scans the network for vulnerable systems. When it finds a vulnerable system, this malware sends a specially crafted packet to produce a buffer overflow on LSASS.EXE. This worm can cause LSASS to crash and force Windows to restart." Microsoft indicates in a security bulletin entitled Windows XP Users: What to do if your computer has been infected by Sasser that you should:
The exact steps are outlined on Microsoft's site, and they also link to a malware remover too, the Microsoft Windows Malicious Software Removal Tool. In general, I strongly recommend that everyone running Windows have both a robust antivirus and antispyware application running. On my systems, I use Symantec's Norton Antivirus for antivirus, and Webroot's Spy Sweeper for stopping spyware, malware, and other infections. So far, so good. Also, make sure you're completely up-to-date with your system updates from Microsoft. I have my systems configured to automatically check for updates from Microsoft and apply them if they're critical security fixes. Ya can't be too safe. Good luck with this situation!!
Help others find this article at Del.icio.us, Digg, Netscape, Reddit, and Stumble Upon
Categorized:
Windows Help
(Article 5857)
Tagged: Previous: Google SMS from a cellphone? Next: How do I get past the Silver Dragon in Radiata Stories? Subscribe!
Never miss another useful Q&A article again! Subscribe to AskDaveTaylor with Google Reader. I had a variant of the LSASS worm on my mother's computer. I had tried both Kaspersky AV and AVG Free, both neither could remove the worm. I'm to the point where I will be installing Debian GNU/Linux on her computer the next time I am at her home. The only thing that had stopped me in the past from this was lack of a linux-useable dial-up modem, but now she's on DSL which linux handles perfectly. I recommend Linux to any PC user because of its relative lack of secuirty issues. Posted by: Matthew Poer at January 23, 2006 6:10 PMWrong answer. I have the same issue and there's no way its the sasser work (or any other virus). I've restored from a known-good tape system onto new disks and get the same error. In short, I'm screwed. Posted by: Rick at September 15, 2006 11:16 AMHi Dave, The problem as you clearly mentioned is that the PC doesn't even boot at all! (it doesn't go beyond the "loading windows xp " screen) Hence, there is no way one can log into windows and take the following steps to solve the problem and remove the virus. I am currently suffering from this and I'll appreciate any immediate solution (or ink to a soultion), please, please, please Posted by: William Ukoh at October 26, 2006 12:48 PMDear Sir, i'm currently going throught his myself and the only solution to this unfortunate problem isd to reinstall windows Posted by: Liz at December 31, 2006 1:25 PMI am having the same problems mentioned most recently (since Oct), running XP home edition. It gets to the splash screen and says lsass.exe system error, object name not found. hi, If your computer keeps booting after your get the lsass.exe error, your security registry hive is corrupt. rename "c:\windows\sytem32\config\security" to security.bak then copy c:\windows\system32\repair\security to the location above. that should do it. My husband's PC just experienced the same error and we can't boot up the PC at all. Nothing worked and I had to reinstall Windows and every application we've ever installed on that PC. We use Norton Anti-virus and Internet Security and we also have Spy Sweeper. We keep up with all updates for both Windows and Norton and Spy Sweeper and still got the worm. Go figure! Posted by: Amy Daly at February 25, 2007 11:31 AMHi My laptop has come up with this error "when trying to update password, this return status indicates that the value provided as the current password is not correct" Before this it said that C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM was missing or corrupted so I replaced it with one in my back up it now gives me the error at the top how can I fix this would putting the original file that didn't work make it easer to fix? David Sounds like the same problem I have. I have been experiencing very poor performance from Office programs on my 3 month old Vaio running XP Home (pre-installed). The problems seemed to be caused by Norton Internet Security (I disconnected my wireless internet connection, disabled Norton and Word and Outlook worked much quicker). I decided to install the OneCare trial. During the install I was forced to remove Norton Internet Security, but apart from that everything went OK. When the machine was shutting down I got an error box saying there was an I/O error and a reference to the registry? When the machine restarted it hung at the Windows XP logo screen, before the user log in page. I tried to restart in safe mode and it hung a driver (mup.exe). I then restarted again and Chkdsk ran and the machine hung at a black screen with a mouse pointer. I then restarted again and I got the following message box. lsass.exe - Unable to locate Component This application failed to start because UxTheme.dll was not found. re-installing the application may fix this problem. When I click OK the machine hangs at a black screen with the mouse pointer, then reboots itself, runs chkdsk and hangs with the following message box lsass.exe - Unable to locate Component This application failed to start because DNSAPI.dll was not found. re-installing the application may fix this problem. I don't have an XP disk as XP was pre-installed - I know I should have created one. I have a full backup using Norton Ghost on an external hard drive - will there be a XP boot on that and, if so, how do I get to it? Posted by: Gordon Watt at March 3, 2007 5:30 AMMy computer has been down for 3 weeks-still no fix.Win XP Home wont boot.Cant get online to download any fixes.Cant access system to do system restore. Goes to Lsass.exe and quits.Just keeps rebooting.Its not a virus as I was changing accounts and security and must of made an incorrect entry that triggered the Lsass.exe.I don't have a win Xp Home disk as it was preinstalled when I purchased computer.Please help. Thankyou Posted by: Richard Cantlay at March 9, 2007 4:09 AMI have the same problem. My computer's been crashing from an overheating problem lately and yesterday it gave me a 'system file corrupted' error. So i followed the MS kb article about restoring the registry files in the system32/config folder, and now its giving me the exact same error you guys are getting. I tried replacing the scurity file from the /repair folder but that didn't fix it either. Someone please help! Posted by: David at March 11, 2007 11:20 PMI have the same problem - windows won't even load up and I get the lsass.exe - unable to locate component error message What is the fix? - I don't see it anywhere on this page? Posted by: Brian at March 14, 2007 5:30 PMWindows is complete garbage, but unfortunately we are almost required to use it nowadays. What the other people say is true; you will end up having to format your HD and install Windows XP again. I had that error before, as well. What none of the Microsoft Techs, or most other advocates of this horrible OS, will tell you is that there is a way to get the data off that you need. You use something called a LiveCD / LiveDVD. It is a version of Linux that is booted from the disk itself. You can use it anytime that you would like. Hell, my Windows works fine and I use it my computer occasionally just for kicks. By booting the computer while this disc is in the drive, you can boot into Linux before Windows. This will allow you to use a CD/DVD burner (internal or external) or a flash drive to get all of your data off and onto discs or another computer temporarily. Just be sure that all peripheral devices (including removable media) are plugged in prior to booting into Linux, otherwise Linux may not recognize it. Posted by: Archangel at March 20, 2007 2:41 AMI had this problem and managed to fix it without a reinstall. Jon Morris' advice of " rename "c:\windows\sytem32\config\security" to security.bak then copy c:\windows\system32\repair\security to the location above. that should do it." Worked perfectly. You can use your XP disk to boot into recovery mode (recovery mode is just a DOS prompt, there's no reinstallation), or if you don't have an XP CD (and you can't borrow one), you may need to look at a third party tool. Great advice though, thanks Jon. Posted by: Aderik at April 22, 2007 6:42 PMI've been getting a diffrent type of lsass.exe error. it tells me "An invalid parameter was passed to a service or function" I tried to repair windows with the XP disk and halfway though the setup it had a crititcal system error and now when it restarts the setup I get the lsass.exe during it. So now for some reason I cant get into the recovery console. any ideas? Posted by: Shawn Chapman at April 28, 2007 9:52 AMI get "lsass.exe System Error. The specified domain did not exist" then an "OK" button to click. Clicking this button (or the "X" that closes this little window")reboots the computer for another cycle of the same thing. I'm going to try some of the above fixes. Posted by: JimStevens at April 30, 2007 9:03 AMjust to quote the following comment Jon Morris' advice of " rename "c:\windows\sytem32\config\security" to security.bak then copy c:\windows\system32\repair\security to the location above. that should do it." Worked perfectly. You can use your XP disk to boot into recovery mode (recovery mode is just a DOS prompt, there's no reinstallation), or if you don't have an XP CD (and you can't borrow one), you may need to look at a third party tool. Great advice though, thanks Jon. the actuall directory of "c:\windows\system32\repair\security" is as follows "c:\windows\repair\security" Ah yeah, and it's "C:\Windows\System32\Config\Security" not "C:\Windows\Sytem32\Config\Security" as well. Just before someone finds it doesn't exist. Posted by: Aderik at May 1, 2007 8:06 PMI went to www.ubcd4win.com (on a good computer) and created a boot CD like one of the posts above mentioned. This boot CD allows you to get into your computer in a psuedo-safe mode so you can at least work on your registry. If you have a CD burner on the bad computer you can also burn files onto a CD to at least recover data if you need to. I couldn't get it to recognize a flash drive though, it would only recognize my installed drives. I found it alot easier than working through the recovery console because you can copy, paste and rename files just like in windows explorer. I was able to change all the files as mentioned in previous posts and my computer was back to normal...for now. =) Posted by: Brad at May 14, 2007 11:00 AMi am using xp and it gets corrupted within 20 days of installation . it displays a message that " windows is unable to boot it might have occured due to hardware changes" . infact i never changed any hardware ever and i use my pc normaly. everytime i shutdown properly but this problem persists for last 4 months pls tell me the solution. Posted by: ramesh at May 20, 2007 11:55 AMrebooted my laptop, I've downloaded the software.to a system and have burnt it on a cd... Instructions would help... Posted by: KENNETH at June 11, 2007 5:01 PMsir,when i boot my win 2003 server pc.it showing lsass.exe file error and sys is nt logging Hi All Thank you very much for your advice I had the lsass.exe problem and the comment from jon morris help me fix it. I used Knoppix v5.1 to edit and copy the files on the windows disk it is now being scanned. Thanks Kevin Posted by: Kevin at September 5, 2007 8:35 PMDear Dave Hi I,ve tried to repair the security file but I still have the same problem, any suggestions other than re-installing windows? Posted by: Lourens Zietsman at September 19, 2007 7:58 AMPleeeeeze spell it out , exactly, for us dummies. I had this problem with Windows 2003 Server! - Boot with your Windows system CD Works like a charm, thanks to Jon!! Cheers!!! Posted by: Marc at September 28, 2007 7:38 AMWell, I cheered to early. I tried the posted solution but now the windows recovery console won't take my administrators password ???? Posted by: dwayne at October 7, 2007 7:20 PMi have win2000 when i on my pc then this take a lot of time to boot. and it is on network and i cheked wire also wire is ok when it boot after a lot of time then i cheked by ping and show reply . Just FIXED my problem by following Joh Morris'; advice...Thanks so much Jon. Requoting Jon Morris' advice of " rename "c:\windows\system32\config\security" to security.bak then copy c:\windows\system32\repair\security to the location above..." Posted by: Arief Budiman at November 8, 2007 6:53 AMI have a emachine an it doesn't have "c:\windows\system32\repair folder. Or could I be misreading the instructions. Should I be at the dos prompt or in the windows folder. My computer is doing the same as everyone else and I do not understand the steps. Could someone help me please? Posted by: Jackie at November 9, 2007 2:39 PMI also can`t even access the computer via safe mode, and a message saying that "there are insufficient system resources available to complete the API" hi, when i try Jon Morris' advice of " rename "c:\windows\sytem32\config\security" to security.bak then copy c:\windows\repair\security to the location above." when i reboot windows the problem continued. Hello Ive got the lsass.exe problem with the rebooting-cycle thingie.. I tried to do the step by step instructions from above but i havnt got a dir called "c:\windows\system32\repair\ <-" the only "repair" dir ive got is located in the windows directory.. can i use that "security" file? Posted by: jonte at November 30, 2007 7:46 AMhi love ur site i am trying to fix a problem u guys do know that if you start your system on safe mode, and sighn in as administrator instesd of owner, you can run your spyware protection and remove the threat. this worked for me today, i was cought in the issas loop also. ignore the "it is not recogmended to scan in safe mode" warning. after scanning restart your computer. be sure to restart, not shutdown. let your computer boot-up normally and run your virus and spyware protection again. after doing so restart your computer and boot it normaly. doing this worked for me, so it should for you. Posted by: dez300 at December 4, 2007 5:00 PMI seem to be having a similar problem. My system file became corrupt, and I, knowing how to repair this, did exactly that. Well, it seemed my whole system32 files were corrupt, so I ran the repair console on everything. After repairing the sam file and the security file, the computer reboots itself and gives the error that updating the password was invalid. So, I tried getting into the recovery console again, but then it asked for the Administator password. (There isn't one). I can't even repair the files, any help on this?? Thanks! Posted by: Colin at December 13, 2007 4:06 PMGUYs i got the error too it says isass.exe system error it says some nmber and a error i will say tat to u and i\even if i log on safe mode i am not able to get it Posted by: GUHAN at January 13, 2008 1:53 AMI just got this @(#&$* lsass.exe problem. My computer will not boot up, period! No matter how many options I try from the F8 screen (safe mode, dos prompt, etc.) it always ends up at the lsass.exe error screen (either lsass.exe has passed a function to another program OR the password file is not as expected; or something similar to those words) and the system reboots. PLEASE HELP ME!!!! I have tried to boot from the original WIN XP PRO CD, but when I do recovery mode, it asks for a administrator password but leaving "Blank" or putting in my windows administrator password doesn't work, and it crashes after 3 tries. I have tried booting from a DOS floppy, but even then the when I trie to access "C" drive, it tells me "invalid drive"!!! I am at my wits end! PLEASE can anyone help me? All I want to do is be able to access the C drive to save my data and then I'll reformat the whole thing.... Posted by: WeHill at January 21, 2008 9:39 PMI normally don't respond to these forums but my heart goes out to you fellas. The reason the administrator password does not work anymore is because when you restore the files from the repair directory, they already have an administrator password associated with them from the OEM (DELL for instance). Recovery the registry and system files by using www.ubcd4win.com Posted by: theodis butler at January 24, 2008 3:14 AMThe correct way to do Jons Tutorial is this 1. Boot into the recovery console using your Windows XP CD. If all goes well, your PC should work. If not try this: Quote from above:
When I change the memory in my e-machines PC (trying to put 1GB, which memory mfg says is below maximum, I get the lsass.exe error that says "endpoint format is invalid", and it will not continue to boot. When I put the old 256MB memory back, it's OK. Any ideas??? Posted by: Steve at February 18, 2008 10:57 AMI have read some of your suggestions. I am wondering if you could help me. I can't get my laptop to turn on the right way. I went to boot it up and I got this window that said lsass.exe with a message that read application error must terminate application, click OK. Not knowing, I did just that. Now I can't get the laptop on to fix the problem. How can I fix this problem without spending hundreds of dollars? Dave the time on my pc changes all whenever I restart my pc the time zone and the date remains OK Posted by: Daid at March 9, 2008 4:57 PMIam yet another victim of the lsass.exe error. I have tried most of the advice that I have read and I still have the problem "Unable to locate component LSASRV.dll" along with the black screen and being locked out of safe mode etc... One thing I haven't been able to figure out though is how to run the UBCD4WIN program. I downloaded it onto CD but I can't get the CD to start up when booting my computer. Any advice? Safe Mode is not an option, since it won't even boot in safe mode. Posted by: JT at March 20, 2008 11:17 PMYou have to run the UBCD4Win program from a working computer and then it will create an ISO to burn to a CD. Stick it in and reboot your PC. Posted by: Theodis Butler at April 3, 2008 10:19 PMI have a hard drive with this issue. I have other functional computers. Can I put this corrupted hard drive into a working computer as a secondary or slave drive and then clean it up and then put it back into the computer the drive is in now? Posted by: James at April 21, 2008 8:42 PMI was burning a song on my floppy drive.I started getting an error I/O no disk . The it starting effecting both of my floppy drives. then it starting effecting my a drive. Now when I boot my computor all I get is a black screen saying I/O error no disk. Can't get past this. Posted by: Brenda at May 4, 2008 1:36 AMI have been battling this system 32 error for over a month at least. I have Formatted and reinstalled XP at least 10 times and now can't even install it anymore. Now am using Windows 2000 and am having problems with that too. My computer reboots and I have seen so many errors and blue screens I just laugh. To whoever lost their disc, hopefully you have your key, that is what you need the most. You can always get a copy of the CD. Posted by: J at June 9, 2008 2:15 AMis there a default admin password for windows? Coz my admin password was reset when i run recovery console (to recover system32) it did boot up but the LSASS.exe keeps rebooting the pc. and now when i return to recovery console it asks for admin password. Is there a default password for this =( Posted by: Mabelle at June 16, 2008 7:32 PMHey Dave .. It's A Great Site .. It's WONDERFUL !!!!! Keep Up The Good Job ;)! I Have A Problem Hope You Can Help Me To Fix It .. I Have An Ecellent Connection * But * I Can't Enter Facebook !! I Mean It's too slow It wasn't like this before !! I Can't Even Enter The Homepage ! Please Help Me :( And Thanks A Lot ♥ Except one or two odd all are out of track. Problem is window is still in installation process. Most of the discussion is for installed OS. Is there any real solution. I also facing the same problem while try to reinstalled from restore CD of my daughter laptop purchased with the machine in UK. - Toshiba Satellite M50-130 with window XP home. Laptop purchased around three years back. AFAQ Posted by: Afaq M. Khan at July 27, 2008 1:40 AMQuoted Above: "I had this problem and managed to fix it without a reinstall. Thanks Matthew for this nice suggestion, i think i saved my desktop to live for another day... it almost took me 2hours to burn the .iso but i dont know why... it's easy to use... burn .iso ---> boot--> registry restore ---> restart and ur computer is same as before being attacked by lsass.exe Posted by: Lawrence at July 30, 2008 9:11 AMI've had a similar problem of the Lass.exe operation. When i try to log into my computer, my account is there, and i can click on it and access it perfectly fine. When i get into my account, i have my blue screen with my cursor (which can move around freely) but no icons, no start menu, no nothing. I tried opening up task manager, and everything seemed to be okay, except the CPU usage was spiking up and down a lot, and so was my network connection. I tried restarting it, shutting it down, and it still came back to the blue screen. I even tried safe mode, and it froze on a black screen with all of the "safe mode" annotations around the sides. My cursor, however, can still move and i could still access taskmanager. No avail. Please help ASAP, as i have not been able to work on it for the past few days. Posted by: Aditya at September 23, 2008 8:40 PMThis post is pertaining to the "lsass.exe error". The error could be "invalid parameter passed" or suspected infection of "Sasser.Worm ". The scenario being "The user is stuck in a position where he/she does not have the access to get past the restarting cycle.Effectively not able to do any changes or modifications suggested." To have checklist(before attempting to troubleshoot) Log on to the other computer. open the the below link in the browser. Request for an evaluation copy by way of email. If you receive the BART CD link fine. Else Google for creating a Bart CD which is pretty simple. "Assumption the user has received BART CD IMAGE file download link" Download the image file. Visit the below link and download the Sasser worm removal tool. http://www.symantec.com/security_response/writeup.jsp?docid=2004-050116-1831-99 Open the image file with ultraiso. Using the add file option add the sasser worm removal tool. Burn the image file to a CD. Power on the system which has to be repaired. Get into the bios settings an set the boot priority to "BOOT FROM CD/DVD". Save the settings. Restart the system and boot with the BART CD. Run a full scan of your system using the virus scanner. This would ensure in eliminating if your system has been compromised by other malwares. You can skip the above option based on your discretion. Now run the Worm removal tool on the CD. This would ensure the removal of sasser worm in the event of your system being infected. Select the option of full install. Select the option of Repair.(Do not select the option of fresh or full install). You can see the drivers and other files being installed which are relevant to your system. Press OK at the error message and the system would restart. Boot the system with BART CD and use the "Servant Salamander" option. This would give you full privilege to the files on the system and has user friendly navigation. Next Browse C:\windows\repair. Use CTRL and left click mouse to select the following files. System Paste(overwrite) the selected files at Restart the system You would find the windows screen displaying "Applying settings" or something similar. Subsequent to a restart,Windows installation would resume similar to a normal installation. Your system would have been restored clean. If you had run an Anti virus Scan or did a registry clean using the BART CD, you might have to reinstall the audio video drivers (remote chances). Important: This post of mine has been compiled to the relevancy from postings from various forums and quite a bit of Google. I have tested this on couple of machines and works fine. This Post has been compiled after testing for the benefit of end users who are not comfortable with Posted by: Ravishankar at December 3, 2008 7:16 PM I have a lot to say, but ...
I do have a comment, now that you mention it!
|
Search
Find just the answers you seek from among our 1700+ free tech support articles by using our Lijit search engine.
Help!
Subscribe to
Ask Dave Taylor! 
Free Updates!
Sign up and get free weekly updates and special offers on books, seminars, workshops and more.
Articles and Reviews
Auctions and Online Shopping Blogs and RSS Feeds Building Web site traffic Business and Management Cell Phones and Mobile Phones CGI Scripts and Web Site Programming Computer and Internet Basics d) None of the Above HTML and CSS Mac OS X Help MySpace, Facebook, Twitter and Social Network Help Pay Per Click (PPC) Search Engine Optimization Shell Script Programming Sony PSP, MP3 Players, Etc. The Writing Business Unix and Linux Help Video Game Tips and Help Windows Help
Recent Entries
Join the List!
Book Links
|
Note: This web site is for the purpose of disseminating information for educational purposes, free of charge, for the benefit of all visitors. We take great care to provide quality information. However, we do not guarantee, and accept no legal liability whatsoever arising from or connected to, the accuracy, reliability, currency or completeness of any material contained on this web site or on any linked site.
![[whiteboard marker tray]](/Graphics/marker-tray.gif){kind=small}
