[gd1975]

Hi,

Im currently running XP Home on my machine. When i attempt to start up my machine im getting the following notification

lsass.exe - Appliation Error the application failed to initialize properly (0xc0000005). Click on OK to Terminate the application

I have ascertained that this is a trojan of sorts but am stuck what to do as i cant boot my machine up to run antivirus/spyware to clean it out. I dont want to format the drive as i have a couple of years of work and personal stuff on it. Is there any way around.

I tried to mount the drives on another machine but cant read the drives....

any ideas are more than welcome

[Advertisements]

lsass.exe: Local Security Authentication Server
Authentic Windows System File, located in c:\windows\System32

The original copy of Lsass.exe can be found on your Windows install disc in the folder i386\lsass.ex_

Start the computer from the Windows CD and boot to the Recovery Console (R, 1, Enter)
On the command line type the following line followed by enter key
extract %cdrom%\i386\lsass.ex_ c:\windows\system32\lsass.exe
Note: %cdrom% must be substituted for your CDrom Drive followed by a colon (ie E: )

Restart your computer, to test if you are now able to logon
If this does not fix the logon fault, continue on below...

----------------

This problem may occur if one or more services that run in the Lsass.exe process or in the Services.exe process are no longer configured to run as shared service processes. By default, services that run in these processes are configured to run as shared service processes.

You can use the Sc.exe tool to determine what service is incorrectly configured. To do this, follow these steps.

• Restart the computer.
• Press the F8 key before the Windows logo page is displayed.
• Press the F8 key to select Advanced Startup Options
• Use the arrow keys to select Safe Mode with Command Prompt, and then press ENTER.

Type the following commands. Press Enter after typing each command:

• Sc query HTTPFilter
• Sc query KDC
• Sc query Netlogon
• Sc query NTLMssp
• Sc query PolicyAgent
• Sc query ProtectedStorage
• Sc query SamSs
• Sc query Eventlog
• Sc query PlugPlay

The TYPE value must be 20 WIN32_SHARE_PROCESS for the services that are listed
Note Services that are configured to run in separate memory processes have a value of 10 WIN32_OWN_PROCESS





Configure what services are individually incorrectly configured
Type: sc config Service Name type= share, and then press ENTER.

Note: Service Name is one of the services that are listed above (ie Netlogon)
Repeat the above for each service that is incorrectly configured
Then Restart
If this does not fix the logon fault, continue on below...

----------------

Start the computer from the Windows CD and boot to the Recovery Console (R, 1, Enter)
On the command line type each of the following lines followed by enter key

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default
Exit

More help here, on this one: http://support.microsoft.com/kb/307545

Then Restart
If this does not fix the logon fault, continue on below...

----------------

System Restore Xp

Microsoft's Windows XP Professional Repair Install step by step

Microsoft's Windows XP Home Repair Install step by step


If this does not fix the logon fault, continue on below...

----------------

Using a Linux Boot CD like Knoppix
Back up your data, and re-install Windows clean (by removing the partition first)
Or restore your image back to your HardDrive

Edited by kimsland, 09 March 2010 - 09:34 PM.

[kimsland]

lsass.exe: Local Security Authentication Server
Authentic Windows System File, located in c:\windows\System32

The original copy of Lsass.exe can be found on your Windows install disc in the folder i386\lsass.ex_

Start the computer from the Windows CD and boot to the Recovery Console (R, 1, Enter)
On the command line type the following line followed by enter key
extract %cdrom%\i386\lsass.ex_ c:\windows\system32\lsass.exe
Note: %cdrom% must be substituted for your CDrom Drive followed by a colon (ie E: )

Restart your computer, to test if you are now able to logon
If this does not fix the logon fault, continue on below...

----------------

This problem may occur if one or more services that run in the Lsass.exe process or in the Services.exe process are no longer configured to run as shared service processes. By default, services that run in these processes are configured to run as shared service processes.

You can use the Sc.exe tool to determine what service is incorrectly configured. To do this, follow these steps.

• Restart the computer.
• Press the F8 key before the Windows logo page is displayed.
• Press the F8 key to select Advanced Startup Options
• Use the arrow keys to select Safe Mode with Command Prompt, and then press ENTER.

Type the following commands. Press Enter after typing each command:

• Sc query HTTPFilter
• Sc query KDC
• Sc query Netlogon
• Sc query NTLMssp
• Sc query PolicyAgent
• Sc query ProtectedStorage
• Sc query SamSs
• Sc query Eventlog
• Sc query PlugPlay

The TYPE value must be 20 WIN32_SHARE_PROCESS for the services that are listed
Note Services that are configured to run in separate memory processes have a value of 10 WIN32_OWN_PROCESS





Configure what services are individually incorrectly configured
Type: sc config Service Name type= share, and then press ENTER.

Note: Service Name is one of the services that are listed above (ie Netlogon)
Repeat the above for each service that is incorrectly configured
Then Restart
If this does not fix the logon fault, continue on below...

----------------

Start the computer from the Windows CD and boot to the Recovery Console (R, 1, Enter)
On the command line type each of the following lines followed by enter key

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default
Exit

More help here, on this one: http://support.microsoft.com/kb/307545

Then Restart
If this does not fix the logon fault, continue on below...

----------------

System Restore Xp

Microsoft's Windows XP Professional Repair Install step by step

Microsoft's Windows XP Home Repair Install step by step


If this does not fix the logon fault, continue on below...

----------------

Using a Linux Boot CD like Knoppix
Back up your data, and re-install Windows clean (by removing the partition first)
Or restore your image back to your HardDrive

Edited by kimsland, 09 March 2010 - 09:34 PM.