lsass.exe system error fix

[Salesman_Gil]

Hello All;
Recently I came accross a computer that had these symptoms:
1) When you boot up you get a dialog box with the title "lsass.exe - System Error", "The Specified Domain Did Not Exist", when you press OK, it reboots.
2) There is no way in to the computer, ie Safe Mode, w/ networking, without networking, commmand prompt, last known good config etc...
3) I did a lot of searching and could not find the fix. A lot of people say that it is the Sasser virus, it is not. I removed the hard drive and scanned it from another computer.
4) It could be a Compaq/Hp thing, as a lot of the computers referneced where Compaq/HP. I have seen these odd model specfic things before, especially with the lsass.exe

The Fix:
Seeing I found no good solution anywhere, I thought I would post what worked for me.
Since I have a lot of the same models, I keep a copy of some important file in the C:\Windows\System32\Config directory.
System
default
SAM
Software
Security

Using Bart's PE, I overwrite these files with the saved files. I also noticed that on some of the models I work on there is a repair (Mine is C:\Repair)directory, that contains these files. I do not like using the repair files though, they tend to be older then the ones I save. After I copy those files, the computer boots right up. The important steps though is make sure you upgrade everything, that way you do not run in to conflicting versions.

If you do not have a repair directory or copies of those files, do a repair installation of XP. I do not do that first, because it seems to have more problems then my method.

Hope this helpful to someone!

[doddsy]

lsass shutdowns? may be sasser worm.

http://securityresponse.symantec.com...er.b.worm.html

[paul9]

A lot of people say that it is the Sasser virus, it is not. I removed the hard drive and scanned it from another computer.

Did you read the post Doddsy?

[andy1984]

Well evidently Isass somehow got deleted, it is a crucial system process, my guess is someone was trying to get rid of a virus/spyware and managed to delete isass from startup using hijack this or similar.

[Salesman_Gil]

Actually the person that was using this computer would not have the knowledge to do any virus spyware removal. She is the perfect user, too scared to do anything she does not know how to do!
(ex. did not know what or how to get into My Computer, one time, and yes it was on her desktop)

[doddsy]

Did you read the post Doddsy?

i did.

in this case the sasser worm was not there. i thought the original post was a wee bit dismissive of the fact that in a lot of cases sasser is to blame.........my post like the original was meant to point to a solution in cases where lsass is causing shutdowns.

[SKBunny]

Hello All;
Recently I came accross a computer that had these symptoms:
1) When you boot up you get a dialog box with the title "lsass.exe - System Error", "The Specified Domain Did Not Exist", when you press OK, it reboots.
2) There is no way in to the computer, ie Safe Mode, w/ networking, without networking, commmand prompt, last known good config etc...
3) I did a lot of searching and could not find the fix. A lot of people say that it is the Sasser virus, it is not. I removed the hard drive and scanned it from another computer.
4) It could be a Compaq/Hp thing, as a lot of the computers referneced where Compaq/HP. I have seen these odd model specfic things before, especially with the lsass.exe

The Fix:
Seeing I found no good solution anywhere, I thought I would post what worked for me.
Since I have a lot of the same models, I keep a copy of some important file in the C:\Windows\System32\Config directory.
System
default
SAM
Software
Security

Using Bart's PE, I overwrite these files with the saved files. I also noticed that on some of the models I work on there is a repair (Mine is C:\Repair)directory, that contains these files. I do not like using the repair files though, they tend to be older then the ones I save. After I copy those files, the computer boots right up. The important steps though is make sure you upgrade everything, that way you do not run in to conflicting versions.

If you do not have a repair directory or copies of those files, do a repair installation of XP. I do not do that first, because it seems to have more problems then my method.

Hope this helpful to someone!

[B71655]

Welcome SKbunny, a re-install fixes quite a few things, hang around, join the group!

[SKBunny]

Thanks I will try once I figure out to join groups

[consultant_at&t]

lsass.exe error may not be due to virus. i have come across a system with lsass.exe error. I am still able to boot and nothing wrong happens. It happened because ups supply of the system is so poor. It doesnt have any back up and so system switches off when ever the voltage is low...After about 100 improper shutdown this error occurred. 2 error messages 1) at time of welcome screen and the message contains some thing like lsass.exe couldnt be loaded so system loads default user 2) at the time after the welcome screen with an error sound after the boot music and message this time would be computer cant locate lsass.exe with the location,,,,,i think it can fixed by the command sfc /scannow with the cd of operating system in cd drive.