Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Re-occurring lsass.exe errors

  • Please log in to reply




  • Member
  • PipPip
  • 38 posts
Ok here is my frustrating story...
A few weeks ago I went to turn on my pc and ended up receiving this error message:
lsass.exe - System error
Indicates a revision number not known by the service. It may be a more recent revision then the service is aware of.

And my pc was stuck in a continual reboot cycle.
I ended up reinstalling XP. Then I was running, Ad-aware SE, McAfee, and Sygate personal firewall, as well as faithfully using windows updates. I also ran some online scans, everything appeared clean.

Now yesterday, I got to turn on my pc and receive this error message:
lsass.exe - System error
When trying to update a password this return status indicates that the value provided as the current password is not correct.

And again caught in a reboot cycle.
I have reinstalled XP again.
When I turned on my pc this morning I received this error message:
Windows File – Protection: Files that are required to run windows properly have been replaced by unrecognized versions to maintain system stability windows must restore original versions of these files.

I am totally confused and frustrated! I am in the process of setting back up all the "safety precautions" and reloading all of the windows updates.
Was/is this the sasser worm? And if so does anyone know how I can be sure it is gone? Or is it a different problem?
Any help or advice would be gratefully appreciated!
  • 0


Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Open the CD ROM drive then put the XP CD in the tray, click start, run, type sfc /scannow then press enter and close the CD ROM drive

Windows File Protection will run and replace the files
  • 0




  • Banned
  • PipPip
  • 35 posts
This is indicative of a sasser (or variant) infection or leftovers from one. Try running the sasser remove tool.
Make sure you've patched all the security exploits on your system relating the the RPC overflow vulnerabilities.


Like keith said, SFC /scannow to check file integrity too.
  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP