lsass.exe system error Solved

Question

Hello everyone, I'm new to the forum. I have a big problem with Windows XP: I can't start because a message appears "lsass.exe system error..." and it keeps restarting. I can't do anything, not even in safe mode. What should I do? Have I lost everything? Sorry if I'm not very precise, but I'm a novice.
Thanks to anyone who can shed some light!

Metralha · Accepted Answer

Me too... I have no idea how to access the DOS on XP... so I continued my research on the web and found the following message...

@+

Metralha

Hello everyone,

I recently had the same problem, and there is a solution (yes!!).
First of all, this error is due to a corruption of the registry (it can happen under certain conditions, such as turning off the PC during a write to the registry, for example). The solution here is to recover an uncorrupted copy of your hive. Obviously, if like 99% of Windows users you don't make regular backups, Kro$oft thought of you....

The simplest idea is to place the hard drive from the malfunctioning machine as a slave on another machine. Open the "System Volume Information" directory with this machine (you will need to first allow the explorer to display system files by unchecking "Hide protected operating system files" in the explorer display options).
You should find a directory of the type _restore{XXXXX}
This directory is filled with directories of the type "Rpx" which correspond to system restore points. Select the most recent one (which should not correspond to today's date). Open it, and then open the subdirectory snapshot.

Copy the following 5 files
_registry_user_.default
_registry_machine_software
_registry_machine_security
_registry_machine_sam
_registry_machine_system

Paste them into the Windows\system32\config directory of the malfunctioning drive
In the same directory, back up somewhere the following 5 files:

default
sam
security
software
system

Then rename

_registry_user_.default
_registry_machine_software
_registry_machine_security
_registry_machine_sam
_registry_machine_system

to

default
sam
security
software
system

There you go, it's done, the machine should boot...
On the first boot, Windows should hesitate a bit, like "detecting new devices," let it do its thing.
For more stability, restore Windows to an earlier date.

There you go, this is a procedure valid for any crash related to a corrupted registry.

guy · Answer

Hello; your problem is the SASSER worm.  http://www.zdnet.fr/produits/logiciels/utilitaires/0,39049794,39151274,00.htm

jmp59 · Answer

Hello,

Indeed, you are not precise at all, but being a novice doesn’t prevent you from providing details about what happens when you turn on your PC. Do you reach Windows, how long does it take approximately before your PC stops and restarts? In other words, everything that happens between the moment your PC starts booting and the moment it stops.

Albator XP · Answer

try an antivirus under DOS!!! and remove lsass.exe!

anicetpatrick · Answer

Salut zavman, juste pour te dire que lorsque cette fenêtre apparaît, ne clique pas sur annuler car ça engage le compte à rebours, laisse cette fenêtre, la machine finira par bien démarrer, après le redémarrage complet, clique sur annuler et attends que ce virus lance son compte à rebours, puis par la suite, ouvre démarrer, exécuter, saisi, shutdown -a (n'oublie pas l'espace entre shutdown et -a) ceci est évident sous XP, sous 2K il faudra télécharger le fichier shutdown.exe. J'espère que je t'aurai aidé.

Belgamo59 · Answer

Hello everyone, here is a useful link @kind regards http://www.commentcamarche.net/virus/sasser.php3

jmp59 · Answer

Hello,

There is a good chance that it will work, although I can't guarantee it.
First, confirmation. You seem to be infected with the Sasser worm. See http://www.commentcamarche.net/virus/sasser.php3

From the PC you are on, go to http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html
Download the FxSasser.exe utility onto a floppy disk by clicking on Download Removal Tool.

On your infected PC, start in MS-DOS mode. Put the floppy disk in its drive. Replace the C:\ prompt with the A:\ prompt and type fxsasser.exe. Press Enter.

@+.

Metralha · Answer

Hello...  I have the same problem as our friend Zavman... did the last action work... I haven't seen the follow-up on the forum...   Thank you

jmp59 · Answer

Hello,  I suppose so, because if it hadn't worked, Zavman would have already come to say so. I ran the test on my PC from DOS, which I hadn't done before sending my message. The verification of my files started successfully, even though that was the point I wasn't sure about. In the end, I received a message saying that Sasser was not found. Of course! Furthermore, the utilities Fx...exe anti-virus from Symantec, I have already used successfully several times, for Netsky and for Mydoom, on infected PCs. But until now, it was from Windows. Anyway, you absolutely risk nothing trying, whether it's from DOS or Windows!  @+.

jmp59 · Answer

I asked some friends around me for advice, and they told me to take out the hard drive and set it as a slave on another one. It's true that it's a solution. But it can be dangerous: be careful not to contaminate the other HDD!  They think it's not Sasser (no countdown, the PC doesn't fully boot...)  You wrote: Unable to start because a message appears "lsass.exe system error..." And on http://www.commentcamarche.net/virus/sasser.php3, it says among the effects of Sasser: abrupt shutdown of 'LSASS.EXE' with an error window displaying: lsass.exe - application error. It looks very similar, and we must not forget that there are many versions of Sasser that do not always manifest in exactly the same way.  @+.

pijay · Answer

Hello

I have a problem with lsass.exe with symptoms

System shutdown initiated by Authority/System The system process: C:\WINDOWS\system32\Isass.exe ended unexpectedly with the status code...

I don't remember the number

So at first glance, Sasser. But what's "funny" is that if I connect to the internet with low-speed Neuf, lsass.exe invariably crashes (as mentioned above) and if I connect with low-speed Tele2: NOTHING?!!!!!!!! Sorry, but I need an explanation! How can a virus activate on one connection and stay dormant on another from the same PC? The response might be "Yes, but it runs in the background, you can't see it, but it's there!" I can understand that, but then why is there a crash with Neuf and not with Tele2? I really don't get it!

Please educate me here!

ayuto · Answer

Hello everyone

I'm interested in the manipulation of setting the HDD as a slave, but when I try to find "system volume information" on another PC, it's a failure: where is this folder?
To get back to pijay and jmp's messages, this morning, while my PC hasn't been connected for a long time, I encountered the lsass.exe problem again. (no startup, and a message saying that it can't find this file)
For your information, I had already encountered this about ten months ago when I had internet. I had resolved the issue quite abruptly by reinstalling XP. I then had issues with random freezes that were eventually resolved by updating the motherboard driver (Asus, Athlon AMD 2600+).

I don't want to reinstall everything!!!

Help

zavman · Answer

Eventually, a friend set my hard drive to slave mode to save the data, then tried to remove Sasser, which wasn't found by the Norton patch! So it's a mystery... I ended up reformatting everything, and that was that.

psyman · Answer

Hello,

Well, I have the same problem, but I formatted directly.

However, upon startup after a hard installation of XP, due to the fact that I can never really copy all the files correctly during the installation, this window appears and automatically reboots my PC.

So if I was infected by the SASSER worm, after formatting, it should be fine???

If someone can help me, I would appreciate it!!!

Best regards.

sauvageon · Answer

Hello,
I was also infected by a form of Sasser (NewHeur) but my antivirus (NOD32) managed to remove it... However, I deleted the infected registry key. The result is that the boot process is normal, the computer neither crashes nor reboots, but the error message is still there at startup... In summary, I still have the message regarding Lsass.exe but no specific issues after... and it's been 2 months now... I believe my problem no longer comes from the virus but from the deleted key.

How can I fix this problem... can't we recover Lsass.exe and reinstall it?

bakedo77 · Answer

Hello, I just came across your messages regarding lsasser.exe - I'm also in the same situation as you with a new PC.. I can't find any answer I can try since I have no access to anything on the screen - have you managed to get rid of this worm or have you formatted your hard drive...? Thanks for your reply if you're still around??

sandy2626 · Answer

Hello everyone
Well, it's neither the SASSER virus nor any other virus, and it's a shame for those who reformatted because Metralha's solution works very well. I followed his instructions step by step to rebuild the registry from a recent correct configuration and it worked like a charm. Thank you very much Metralha, and for the others, listen to good advice next time!
Good luck to everyone
Sandy

antoine · Answer

Thank you very much Metralha :D :D

antoine · Answer

The question has been around for a long time but we never know, it can always be useful    re.lem you put the hard drive in an external case or in the PC by changing the jumper to SL (slave)

tomlcf · Answer

Hi everyone, I'm reviving the topic because I've just experienced, with a few details aside, the same troubles as some of you.

I'm running on XP SP2. Upon starting the PC, everything is normal until the Windows screen with the loading animation below.
The startup procedure seems to be stuck at this stage and I can't move on to the next Windows logon screen.

Instead, I get a dialog box:

lsass.exe component not found

This application failed to start because WINMM.dll was not found. Reinstalling this application may solve this problem
__________
|___OK____|

I click OK and another window opens

lsass.exe - Component not found

Error processing message c0000135 parameters 10010 75afbf9c 75afbf9c 75afbf9c

__________
|___OK____|

I booted from my Windows CD to perform a repair

So I choose R to repair my Windows partition and instead of staying on the blue screen
it switches to DOS (...) asks me which volume I want to "log on" to, I only have one volume
so I choose this volume 1, and I'm asked for the admin password, which I didn't create, so I hit enter, but then I'm a bit lost.

I'm left at C:\WINDOWS> and I don't know what to do...

A little help would be appreciated.

Best regards!

Tom

P.S. If you need more info, I'm available ;)

P220v · Answer

A big thank you to Metralha for his recovery method :-) :-) !!!!

youlie0708 · Answer

Hello, I had exactly the same problem as ZAVMAN with my computer. I managed thanks to a system restore in safe mode. Give it a try and let me know what you think. See you later!

kevreg · Answer

Hello, since this morning I've been having the same problem when I turn on my laptop (Aspire One D150-0BW) an error message appears "lsass.exe - system error" "an invalid parameter was passed to a service or function" and when I click ok or close, the same page with the error message reappears  so if someone could help me that would be nice because I'm not very good with computers  thank you.

ludoweb · Answer

Hello everyone,

I carefully read this topic thinking I would find the solution to this problem, but unfortunately, on the computer I was asked to fix, there was no restore point created. I therefore find myself with the "System Volume Information" folder completely empty and it's very frustrating!
If anyone knows another solution ... for now I'm searching but without success.

Lsass.exe system error

24 réponses

Canon mb5350 - cartridge replacement impossible

Texture issues in enshrouded

Select next line csh foreach

Win32 kamso then rootkit detection

Win32:spyware-gen [trj] detected by avast

Unknown video error on the freebox player

Make it or break it

How to open a cbr file

Please log in with manager privileges.

Wake on lan with livebox