[sonicyouth1984]

Hi guys,

Bare with me, I'm not too technical although have managed to fix a problem on a different computer through here in the past so I have the faith!

I am runnng Windows XP and when I start up I get the error message, "lsass.exe. system error". in the box it says when trying to update this return status indicates that the value provided as the current password is not correct. It then reboots before I get into Windows.

I have read up on this through Google and many of the solutions (although many are presented in a confusing manner without a definitive solution) require the Windows disc. My computer came with Windows XP pre-installed, my dad bought it for me within the cheapest of budgets.

I understand the situation but have not found a solution without a disc. I've tried to boot up under safe mode but it appears to crash.

This all came from having internet connection problems, my housemate suggested that I probably picked something up from bittorrent and to use the system recovery tool, which I did rather naively.

I hope you can help guys, I'm in my final year of Uni so having a computer is quiet useful, thankfully I backed up all my uni work but nothing else. Preferably I would like to keep my hard drive as it is but if I need to delete everything, I'm prepared to do so.

[Advertisements]

Hello sonicyouth1984, welcome to G2G.

Need some clarification please. You said and to use the system recovery tool, which I did rather naively. Does this mean you have tried to use the Recovery Partition or Recovery CD provided with your computer? If so, did you do a destructive (with format) recovery or a repair (over the existing) recovery?

[Ztruker]

Hello sonicyouth1984, welcome to G2G.

Need some clarification please. You said and to use the system recovery tool, which I did rather naively. Does this mean you have tried to use the Recovery Partition or Recovery CD provided with your computer? If so, did you do a destructive (with format) recovery or a repair (over the existing) recovery?

[sonicyouth1984]

Thanks for the prompt response ztruker.

I did a repair using the recovery partition that is actioned when pressing F10 during bootup, no CD or disc involved.

[Ztruker]

Okay, it's quite probable you have picked up some kind of malware. lsass.exe has/had a vulnerability that made it susceptibel to a virus attack. I think it was called sasser worm or something like that.

Read through this area:

Cleanup Your System.

This takes care of the many of the problems without further action by the Malware Gurus on this site.

If this doesn't do it, post a HijackThis log here:

Malware Removal Forum.

Make sure you read the You Must Read This Before Posting A Hijackthis Log article before posting.

Please be patient, this is a very active anti-malware site and the malware removal experts are extremely busy. It can take 1 to 3 days for them to get to you.

[sonicyouth1984]

Hi,

I've read through the link and the addtional malware forum and am struggling to find a place to start. I couldn't find a self-help guide to remove a sasser worm and as I am unable to boot into windows or safe mode I can't start up any of the suggested programs such as the cleaner and Hijack This. I'm not sure if I can do any of this in command prompt or indeed how I would get into command prompt without the computer automatically re-booting before I am able to do anything.

I'm extremely busy at the minute with work (as I imagine you guys are too!) so I'm sorry if I've missed a posting on the malware forum. I did however find the following link which is similar to my situation

http://www.geekstogo...ser-t97709.html

Can this help?

[Ztruker]

I read through the link you posted, but it's different. The person there could boot to Safe Mode so was able to get a HJT log and run programs to fix the malware.

Question: Have you tried selecting Last known good when you get to the Windows Selection screen after pressing F8? If not, try that. If it won't boot, try getting into Safe Mode again.

[sonicyouth1984]

I have tried both last known good and safe mode and both immediately reboot when starting up. Unfortunately it looks like every option in setup reboots.

[Ztruker]

Okay then. At this point I would say to go ahead and post here: Malware Removal Forum.

Explain your situation, that you can't boot your computer to get a HJT log, etc. Also post a link back to this thread.

http://www.geekstogo...22#entry1155222

[sonicyouth1984]

Have done so Ztruker, the link is http://www.geekstogo...rm-t187089.html

Thanks for your help!

[Ztruker]

Excellent. Please post back here is you have any problems you need help with once your system receives a clean bill of health.