Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lsass.exe - System Error


  • Please log in to reply
7 replies to this topic

#1 nick_kjaer

nick_kjaer

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:06:06 PM

Posted 01 June 2008 - 01:23 PM

Hi again,

This is ridiculous, last time I spoke to you guys about Jan time I had this error and the only way to overcome it was to reinstall Windows from scratch. Now only a few months later the error has returned. Is anyone able to explain what the issue with it is. I hear from some posts that it is to do with microsoft secure login or something and that it is simply a legitimate failure, but in some other posts I read that it was a backdoor trojan or something like this and that people may be hacking my computer to gain financial information etc. I immediately disconnected my wireless card (if this was really the case), so presumeably they can't access my passwords and stuff anymore?

I am wondering if it is just a terminal like failure of my laptop. I have had it for 5 years now and it really seems to be on its final legs. The fan runs on overdrive at all times, it heats up really quick to the point where the wireless card seems to malfunction due to heat and the internet is pretty slow considering we have a fast connection and it works better on my flatmates laptops. Am thinking perhaps of just getting a new laptop, but what about the hacking issue? Do I need a new laptop, or is it just a coincidence that I have now had this same error in the past 5 months etc? Don't mind buying a new one (could do with one afterall) just bit peeved at having losts a load of photos etc for the second time around. Also I am worried about getting a new laptop as I hear Vista is pretty crap - is this still the case? Basically what are your thoughts, should I:
- Just bin my laptop and start afresh?
- Bin my laptop but still change all my passwords (notify banks etc of the hack - if this is the issue)?
- Repair Windows using the recovery disk?
- Re-install Windows entirely?

I have an external hard-drive, but am not sure how to get the files from my laptop onto it seeing as that I can not start up the computer. Everytime it loads it stops half way through, goes to a black screen and then a Windows box pops up and says exactly "lsass.exe - System Error Object Name not found" It's the very same one I got last time which was only fixed by re-installing Windows. If I click on OK it restarts, if I click on the X it restarts and if I do nothing, it too does nothing, just sits there waiting for me to make first move.

Cheers for any help and advice guys, really appreciate it. Man computers drive me mad.

Thanks, Nick

BC AdBot (Login to Remove)

 


#2 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:06 PM

Posted 01 June 2008 - 01:43 PM

Hello.

Have you tried to use the System File Checker? If it is indeed a problem with lsass.exe them SFC should be able to correct it.

With Regards,
The Panda

#3 nick_kjaer

nick_kjaer
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:06:06 PM

Posted 01 June 2008 - 02:57 PM

No can't access unfortunately as my computer will not start at all, not even in Safe Mode.

#4 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:06 AM

Posted 01 June 2008 - 05:14 PM

Try this. Insert the Windows XP CD into the CD drive, and then restart the computer. Click to select any options that are required to start the computer from the CD drive if you are prompted. When the "Welcome to Setup" screen appears, press R to start the Recovery Console. If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.

Type: chkdsk /r

It's important to have a space before the "/".

To exit the Recovery Console and restart the computer, type exit at the command prompt, and then press ENTER.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:06 PM

Posted 01 June 2008 - 06:35 PM

Lsass.exe is both a legitimate program and malware. It all depends on it being the legitimate file or a piece of malware.
There was an old exploit of it that was fixed with SP2 - so if you've got SP2 you're safe from the exploit.

The good copy of Lsass.exe (Local Security Authority Service) is located in C:\Windows\System32 As long as this hasn't been replaced by malware (not likely, but possible) it should be OK. If it's located in $NTServicePackUninstall or in ServicePackFiles it's likely OK - anywhere else and it's likely to be bad.

If you can get at it's properties, post the version, size, and date information so someone can compare it with their copy.

My XP SP3 info for it is:

Version: 5.1.2600.3205
Size: 13.0 KB (13,312 bytes)
Size on disk: 16.0 KB (16,384 bytes)
Created: Tuesday, February 28, 2006, 8:00:00 AM
Modified: Saturday, September 01, 2007, 5:20:56 AM
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 nick_kjaer

nick_kjaer
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:06:06 PM

Posted 02 June 2008 - 02:29 AM

Cheers for all the help guys, I got bit fed up with the failing/infected piece of rubbish so I just used the QuickRecovery CD's and restored it to factory settings. Now it is working fine but of course I have lost all my files etc. The fan is still blowing like mad so I suspect the hard drive is on it's last legs therefore am just going to go buy a new laptop at some point, quick question though, if I were to take the laptop to someone with half a clue about computers (or even a registered person, maybe even PC World) would they be able to retrieve those files for me? Is just a couple of photos (like 70 approx) so not the end of the world if they can't but just would be nice if they can. I know I restored my laptop to factory settings, but you're always reading about bad guys being caught for having bad files on their computers long after they thought they'd wiped them so using that weird analogy am hoping some guy from PC World or the like could retrieve my photos which were on my desktop until only a day ago. Thanks for your thoughts on this, Nick.

#7 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:06 PM

Posted 02 June 2008 - 05:26 AM

It depends on the data recovery services that are offerred by your local PCWorld. Since the files have been overwritten, they may not be recoverable - and if they are recoverable, it's gonna be expensive!

If your fan is continuously running, I'd suggest getting some canned air and blowing out all the vents on the laptop. Turn it off and turn it over to access them all. You can use a paper clip to keep the fan from moving while you blow it out. (PS - don't use a vacuum cleaner or an air compressor to do this as it may cause damage).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#8 nick_kjaer

nick_kjaer
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:06:06 PM

Posted 02 June 2008 - 04:58 PM

cool thanks did that before, the vents are all fine. bit annoying bout the files, would have thought would be a simple procedure. oh well thanks anyway john.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users