[eks]

Check out article #MS KB307545 at support.microsoft.com for step by step instructions on restoring a corrupted registry (if that is your problem). In my research on this topic, it appeared that the virus related issues show error messages referring to isass, but mine was lsass. It was a nightmare fixing that problem. Good luck!

[Advertisements]

Hi,

Same problem with me on my inspiron 5150. Can you please help me in sorting this thing out. I dont have any second hard disk. Please let me know how you resolved this problem on your system? If re install is required, can i create a partition on the same disk at recovery console and install xp on this afresh? Please help me !!!

[bhasurup]

Hi,

Same problem with me on my inspiron 5150. Can you please help me in sorting this thing out. I dont have any second hard disk. Please let me know how you resolved this problem on your system? If re install is required, can i create a partition on the same disk at recovery console and install xp on this afresh? Please help me !!!

[jamesEdwards1]

Same problem here on a Toshiba satelite laptop A30

There is no spare hard disc, and i cannot log into the recovery mode from the xp setup, as the administrator passowrd is not recognised (there shouldnt be one)

I cannot copy, move or rename any files, or create another partition on the disk without running DOS, and i have NTFS which apparently wont run DOS

thanks in advance

James Edwards

[vas2000]

I called HP Support and they said it was a Win XP bug (not related to a virus). I landed up having to get the data off the hard drive (which was fine) by plugging it into my desktop and used the recovery CD's to put a new XP image on to the laptop.

[jamesEdwards1]

i managed to load a dos based program that effectively turns off syskey and resets all the passwords, which meant that i was able to boot windows in safemode properly and fix the broken registry files

Then after everything was as it should, reactivated all the security features (syskey) and hopefully it will be happy

[jamesEdwards1]

OK, since two people PM'd me about this, here is how i fixed my system

After trying the method using the MS knowledge base article (didnt realise my XP was an OEM version) i couldnt log into the recovery console. Also when restarting safemode, or any part of XP, the system told me Lsass had a bad value, and reebooted.

The laptop is running NTFS, which means that i couldnt run DOS to move/edit the broken registry hives.

After trying everytihng, including using a password changing utility to alter the administrator password, i still couldnt access the repair mode of windows setup.

THE NEXT PART SHOULD ONLY BE TRIED IF EVERYTHING ELSE FAILS

I found a program, which is a bootable cd that has all sorts of useful tools on it. There is a password modifier included. I used this password program to deactivate Syskey.exe, which is a very important security feature of windows. http://home.eunet.no...rdahl/ntpasswd/

Read this first : http://home.eunet.no...sswd/syskey.txt

After deactivating syskey and reebooting, since syskey is deactive, windows will load into safe mode, and you can continue the other steps in the original knowledge base articles, including moving restor files, and running the repair function of windows setup to complete the operation.

This technique worked for me, and allowed me access to windows and restore the registry from a system restore point.

It is important that when you have everything sorted, you MUST restart syskey.exe (details on MS website)


If there is an easier (and safer) way to solve this problem, i would like to know it.
Make sure no-one get access to your pc whilst syskey is deactivated, so disconnect any network access.

[MRJCBeck]

This issue has just happened to me yesterday. My laptop was functioning perfectly over the weekend while I was out of town. I came back into the office yesterday and put it into the docking station and bam, there was the blue screen with the "STOP: 0000218..."

I have tried this so far:

- Last Known Good
- Every type of safe mode
- Recovery console through XP installation disc (would not accept my password)
- Repair of XP through installation disc
- Boot disc into DOS with various data recovery applications to pull data from C:\ but boot disc is not allowing me to access the C:\ drive so app is no good
- Just ordered new memory as this may be a problem

At this point I think it's just best to pull my data from the drive and rebuild.

However, I can't seem to find a solution that will allow me to boot to DOS using a CD, use a data recovery app, and copy all of my files over to a USB drive.

Please help.

[wh1stler]

I ran into one of these today and was able to get it fixed using a combination of BartPE and Winternals. I was basically stuck in a situation where the system i was working on (Sony Vaio) apparently was built with Sysprep and the normal restore console was unable to get past the admin login. You can perform all of what is required from the KB article with winternals ability to view and modify the file structure.

After booting from the PE disk I was able to grab the SAM,SECURITY,DEFAULT,SOFTWARE and SECURITY from a recent RP### directory under the c:\system volume information\_restore.....\RP###\snapshot and copied the files to the c:\windows\system32\config directory. The next boot she fired right up and worked as before.

Basically I followed the KB article http://support.microsoft.com/kb/307545 but used the external boot disk with winternals rather than the internal console to perform most of the steps.


-W

[underworld]

I found a program, which is a bootable cd that has all sorts of useful tools on it. There is a password modifier included. I used this password program to deactivate Syskey.exe, which is a very important security feature of windows.

After deactivating syskey and reebooting, since syskey is deactive, windows will load into safe mode, and you can continue the other steps in the original knowledge base articles, including moving restor files, and running the repair function of windows setup to complete the operation.

arghh not even this works for me!!! I used the boot cd to disable syskey, but everytime I reboot and enter windows safe mode or not it manages to reactivate syskey because the lsass.exe error reappears and computer reboots

then when i check syskey status in the boot cd i realize it's on again so while booting windows it always activates syskey

ANY HINT PLEASE?

If only i could enter windows even in safe mode I could start registry booster and restore a previous registry backup...

EDIT: but i now get access to prompt after booting with windows boot cd and presing r to go to prompt...

Edited by underworld, 08 July 2007 - 05:31 AM.

[underworld]

EDIT: but i now get access to prompt after booting with windows boot cd and presing r to go to prompt...

i'm now able to boot windows after doing this:

md tmp
copy C:\windows\system32\config\system C:\windows\tmp\system.bak
copy C:\windows\system32\config\software C:\windows\tmp\software.bak
copy C:\windows\system32\config\Sam C:\windows\tmp\sam.bak
copy C:\windows\system32\config\security C:\windows\tmp\security.bak
copy C:\windows\system32\config\default C:\windows\tmp\default.bak

delete C:\windows\system32\config\system
delete C:\windows\system32\config\software
delete C:\windows\system32\config\Sam
delete C:\windows\system32\config\security
delete C:\windows\system32\config\default

copy C:\windows\repair\system C:\windows\system32\config\system
copy C:\windows\repair\software C:\windows\system32\config\software
copy C:\windows\repair\sam C:\windows\system32\config\sam
copy C:\windows\repair\security C:\windows\system32\config\security
copy C:\windows\repair\default C:\windows\system32\config\default

problem is registry is clean, it seems to be the registry after a windows instalation, i can enter programs but they seem like they never have been used. The registry seems to be from before installing the programs...

i start registry booster but I cannot see the regsitry backups i did... anyone knows where registry booster keeps the regsitry backups and how can I restore them?

[underworld]

ok, I copied sam, security, software, default.bak again to c:\windows\system32\config and renamed them

now windows starts and it stops in the user chose menu and the 3 users I had appear as normal. I had no password before, problem is now it asks for password... disabling syskey with boot cd doesn't work

i think i'm almost there, i think if i can get past this password problem the registry is now ok and o can open the programs and make backups of data...

any hints to crack this password problem?