Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

lsass.exe On Booting Up


  • This topic is locked This topic is locked
35 replies to this topic

#1 Booh-kitty

Booh-kitty

  • Members
  • 254 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:La-La Land
  • Local time:03:23 AM

Posted 20 May 2011 - 06:20 PM

****This not the computer in my profile************

I'm trying to fix an old computer I got for free. (My friends think I'm crazy when I tell them I like doing this kind thing!)

On booting up, after the XP screen appears, I get the message

System Error
lssass.exe
Object not found

I get this same result for:
-All safe mode options
-Using the installation disk to repair Windows
-Using the installation disk to completely reinstall Windows

Debugging does nothing. Restore to last good settings doesn't work.

The searches I've done for this error indicate that the file is missing, miss-configured or corrupted.

I found this fix,

Fix lsass.exe

but there are no directions for use. When I click the link, it automatically starts a download.

I thought about just completely wiping the entire hard drive, but that wouldn't be as much fun :) Plus, I'm not sure it would work.

Edited by Booh-kitty, 20 May 2011 - 06:20 PM.

Whether you think you can or can't, either way you are right.
-Henry Ford

BC AdBot (Login to Remove)

 


#2 Sneakycyber

Sneakycyber

    Network Engineer


  • BC Advisor
  • 6,130 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:04:23 AM

Posted 20 May 2011 - 08:27 PM

First you will need a copy of A Windows CD/Rom. The only thing that matters are the instructions for the next part so let me know what cd you are using.
Chad Mockensturm 
Network Engineer
Certified CompTia Network +, A +

#3 Booh-kitty

Booh-kitty
  • Topic Starter

  • Members
  • 254 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:La-La Land
  • Local time:03:23 AM

Posted 20 May 2011 - 10:04 PM

I've tried to reinstall windows xp. The computer still tries to boot up from the hard drive, even after I change the settings to boot from the CD Rom. I get the same message either way.

Thanks for looking at this!

Edited by Booh-kitty, 20 May 2011 - 10:05 PM.

Whether you think you can or can't, either way you are right.
-Henry Ford

#4 Sneakycyber

Sneakycyber

    Network Engineer


  • BC Advisor
  • 6,130 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:04:23 AM

Posted 20 May 2011 - 10:14 PM

Does it recognize a CD/Rom drive as being installed in the bios?
Chad Mockensturm 
Network Engineer
Certified CompTia Network +, A +

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 56,266 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:23 AM

Posted 21 May 2011 - 08:25 AM

FWIW: Possible malware, I will post this on the Unbootable topic here...someone from the malware side of the house should take a look soon.

Louis

#6 Booh-kitty

Booh-kitty
  • Topic Starter

  • Members
  • 254 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:La-La Land
  • Local time:03:23 AM

Posted 21 May 2011 - 09:10 AM

Should I look for this thread in that forum instead for answers? I didn't put it in malware because I didn't find anything about it being malware.
Whether you think you can or can't, either way you are right.
-Henry Ford

#7 Sneakycyber

Sneakycyber

    Network Engineer


  • BC Advisor
  • 6,130 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:04:23 AM

Posted 21 May 2011 - 09:27 AM

I am just trouble shooting at this point since I am un-sure exactly what the problem is. However after Re-reading your first post I am left still with the question does it recognize a CD/Rom drive being installed in the bios? If its not recognized in the bios you won't be able to boot from it and it will automatically go to the next boot device. If the drive is listed and it is not accessing the cd/rom properly then we have another problem all together. I am going to have you perform Checkdsk/r and have it check the windows file system for errors and replace any found. You will need to get to the DOS prompt using a Windows XP/Vista Cd and the recovery console or gain access to the hard drive through the computer. You could also install the problem drive in a working computer and run Checkdsk from there.

Starting the Windows Recovery Console from the Windows XP CD-ROM

If you have not preinstalled the Windows Recovery Console, you can start the computer and use the Recovery Console directly from your original Windows XP installation disc. If your computer is already in Windows and you want to add the Windows Recovery Console as a startup option, go to the next section "Adding the Windows Recovery Console as a startup option."
  • Insert the Windows XP CD into your CD drive and restart your computer. If you are prompted, select any options required to start (boot) from the CD.
  • When the text-based part of Setup begins, follow the prompts. Select the repair or recover option by pressing R.
  • If you have a dual-boot or multiboot system, select the installation that you want to access from the Recovery Console.
  • When you are prompted, type the Administrator password.
  • At the command prompt, type Recovery Console commands, and then you can refer to the commands that are listed in the "Available commands within Windows Recovery Console" section.
  • At any time, you can type Help for a list of available commands.
  • At any time, you can type Help commandname for help on a specific command. For example, you can type help attrib to display the help on the attributes command.
  • At any time, you can exit Windows Recovery Console by typing Exit at the command line.


How to run Chkdsk at the command prompt

  • Click Start, and then click Run.
  • In Open, type cmd, and then press ENTER.
  • Use one of the following procedures:
  • To run Chkdsk in read-only mode, at the command prompt, type chkdsk, and then press ENTER.
  • To repair errors without scanning the volume for bad sectors, at the command prompt, type chkdsk volume:/f, and then press ENTER.

    Note If one or more of the files on the hard disk are open, you will receive the following message: Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Type Y, and then press ENTER to schedule the disk check, and then restart your computer to start the disk check.
  • To repair errors, locate bad sectors, and recover readable information, at the command prompt, type chkdsk volume:/r, and then press ENTER.

    Note If one or more of the files on the hard disk are open, you will receive the following message: Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Type Y, and then press ENTER to schedule the disk check, and then restart your computer to start the disk check.
How to run Chkdsk from My Computer or from Windows Explorer
  • Double-click My Computer, and then right-click the hard disk that you want to check.
  • Click Properties, and then click Tools.
  • Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
  • Use one of the following procedures:
  • To run Chkdsk in read-only mode, click Start.
  • To repair errors without scanning the volume for bad sectors, select the Automatically fix file system errors check box, and then click Start.
  • To repair errors, locate bad sectors, and recover readable information, select the Scan for and attempt recovery of bad sectors check box, and then click Start.
Note If one or more of the files on the hard disk are open, you will receive the following message: The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer? Click Yes to schedule the disk check, and then restart your computer to start the disk check.The following table lists the exit codes that Chkdsk reports after it has finished:
Exit codeDescription0No errors were found. 1Errors were found and fixed. 2Disk cleanup, such as garbage collection, was performed, or cleanup was not performed because /f was not specified. 3Could not check the disk, errors could not be fixed, or errors were not fixed because /f was not specified.




Edit: Advisor's in the other Forum will see this topic and post their reply's as such you can receive help in this thread

EDIT 2: Changed instruction order the original was a kind of confusing

Edited by Sneakycyber, 21 May 2011 - 02:02 PM.

Chad Mockensturm 
Network Engineer
Certified CompTia Network +, A +

#8 Booh-kitty

Booh-kitty
  • Topic Starter

  • Members
  • 254 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:La-La Land
  • Local time:03:23 AM

Posted 21 May 2011 - 09:44 AM

I got your last message late last night. I just got up and haven't checked the BIOS yet. Plus, I have to disconnect the monitor from my computer to the old one to see anything. I'm too lazy just now to do that! I'll check it soon though.

However, when I put the installation disk in and then reboot, it still goes straight to the same message I keep getting. I'll check all the things I can get into.

Right now I know that it won't start up in Safe mode.

Let me wake up a bit more :)

I'm also out of coffee :(

Thank you so much for your help! I get learn something more today!

Edited by Booh-kitty, 21 May 2011 - 09:48 AM.

Whether you think you can or can't, either way you are right.
-Henry Ford

#9 Sneakycyber

Sneakycyber

    Network Engineer


  • BC Advisor
  • 6,130 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:04:23 AM

Posted 21 May 2011 - 11:01 AM

Take your time, the coffee is important! I prefer Mt Dew myself :busy:
Chad Mockensturm 
Network Engineer
Certified CompTia Network +, A +

#10 Booh-kitty

Booh-kitty
  • Topic Starter

  • Members
  • 254 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:La-La Land
  • Local time:03:23 AM

Posted 21 May 2011 - 12:19 PM

First of all, I don't think I was clear about what the problem was in my original post. The OS will not start up at all. It tries to, but I immediately get the message, lsass.exe. This being the case, I can't use windows explorer to do anything. I can't get to the windows recovery console from the installation disk either.


This is what I've got to report:

  • Yes, the BIOS does recognize the CDROM
  • I put the installation disk in the drive before starting up. Although I could hear the CD spinning, I still got the same message
  • In BIOS, I changed the boot order to boot first from the CDROM. After doing so, I exited BIOS, and then went back in to check that the boot order had been changed. It was not.
  • I tried booting with again anyway after changing the settings. (Maybe it had been changed? I thought I would give it a try just in case). I got the same message.
  • I went to the advanced start up options (F8) and tried every single one of the options to see if I get could get into the OS system at all. None of them worked.
  • The mouse doesn't work and hasn't since I got this computer. I've tried several different mice to no avail.
  • I'm also getting a message now that key 42 is stuck. I tried several different keyboards with no affect.
  • And finally...........the next to last time I tried to turn on the computer, I heard a repeating series of 3 beeps. 3 beeps pause, three more.........on and on until I just turned it off. A few minutes later, it turned on, but the OS still won't boot up.

I remember reading somewhere that those 3 beeps means that the hard drive is shot. I'm going to post again in the hardware forum.

************I'm really glad this is just a fun project for me and not my computer that I rely so heavily on!***********

Edited by Booh-kitty, 21 May 2011 - 12:20 PM.

Whether you think you can or can't, either way you are right.
-Henry Ford

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 56,266 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:23 AM

Posted 21 May 2011 - 01:40 PM

<<I'm going to post again in the hardware forum>>

Please...do not do such...until this topic has been terminated.

Louis

#12 Sneakycyber

Sneakycyber

    Network Engineer


  • BC Advisor
  • 6,130 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:04:23 AM

Posted 21 May 2011 - 01:46 PM

The bios beep codes depends specifically on the bios your computer is running most popular are Phoenix/Award and AMI and it could change with BIOS revisions. The general beep codes can be found here. According to that list its memory related (if you have the mentioned Bios versions). Since you cannot boot from the Cd/Rom drive its difficult to run any programs to diagnose the HDD or the memory. Unless you have a bootable USB drive and wish to install windows on it.One last ditch question on the cd/rom drive you are SAVING the configuration after changing the boot order before exiting the Bios setup and the Bios remembers the changes when you reboot and check the settings? As for the checkdsk option to run from Windows you could do that if you installed the HDD into the computer your posting from.

Edited by Sneakycyber, 21 May 2011 - 02:00 PM.

Chad Mockensturm 
Network Engineer
Certified CompTia Network +, A +

#13 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:04:23 AM

Posted 21 May 2011 - 01:55 PM

Hi, :)

:welcome:

Try this please. There are multiple tasks to perform. Read carefully. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will install a little bootable OS on your USB device
  • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/driver.sh to your USB
  • Also Download Query.exe to the USB drive. In your working computer, navigate to the USB drive and click on the Query.exe. A folder and a file, query.sh, will be extracted.
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • The computer must be set to boot from the USB drive
  • In some computers you need to tap F12 and choose to boot from the USB, in others is the Esc key. Please consult your computer's documentation.
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Then type bash driver.sh -af
  • Press Enter
  • You will be prompted to input a filename.
  • Type the following:

    Winlogon.exe

  • Press Enter
  • If successful, the script will search for this file.
  • After it has completed the search enter the next file to be searched
  • Type the following:

    volsnap.sys

  • Press Enter
  • If successful, the script will search for this file.
  • After it has completed the search enter the next file to be searched
  • Type the following:

    explorer.exe

  • Press Enter
  • After it has completed the search enter the next file to be searched
  • Type the following:

    Lsass.exe

  • Press Enter
  • After it has completed the search enter the next file to be searched
  • Type the following:

    Userinit.exe

  • Press Enter
  • After the search is completed type Exit and press Enter.
  • After it has finished a report will be located in the USB drive as filefind.txt
  • While still in the Open Terminal, type bash query.sh
  • Press Enter
  • After it has finished a report will be located in the USB drive as RegReport.txt
  • Then type dd if=/dev/sda of=mbr.bin bs=512 count=1


    Leave a space among the following Statements:

    dd is the executable application used to create the backup
    if=/dev/sda is the device the backup is created from - the hard drive when only one HDD exists
    of=mbr.bin is the backup file to create - note the lack of a path - it will be created in the directory currently open in the Terminal
    bs=512 is the number of bytes in the backup
    count=1 says to backup just 1 sector


    It is extremely important that the if and of statements are correctly entered.

  • Press Enter
  • After it has finished a report will be located in the USB drive as mbr.bin
  • Plug the USB back into the clean computer, zip the mbr.bin, and except for the mbr.bin zipped file, post the contents of the report.txt, filefind.txt and RegReport.txt in your next reply. The mbr.bin zipped file must be attached to your reply.

Please note - all text entries are case sensitive

Edited by JSntgRvr, 21 May 2011 - 01:57 PM.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#14 Eyesee

Eyesee

    Bleepin Teck Shop


  • BC Advisor
  • 3,545 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:In the middle of Kansas
  • Local time:03:23 AM

Posted 21 May 2011 - 01:56 PM

A hard drive failure will not cause beep codes on post.
I would reseat the memory and video card.
If the system has multiple ram sticks test it with one at a time.
If there are additional cards in the system reseat them as well.
In the beginning there was the command line.

#15 Sneakycyber

Sneakycyber

    Network Engineer


  • BC Advisor
  • 6,130 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:04:23 AM

Posted 21 May 2011 - 01:59 PM

The unbootable PC experts have arrived. You are in good hands :clapping:

P.S. I completely for got about Ubuntu and "PE" on a USB stick. Too much time in the networking forums. :blink:

Edited by Sneakycyber, 21 May 2011 - 02:01 PM.

Chad Mockensturm 
Network Engineer
Certified CompTia Network +, A +




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users