Windows XP Pro.  Ntldr missing and wont boot. Also Lsass.exe issues

Posted on 2004-09-26
Last Modified: 2008-01-09
Symptoms were:

On Power on Boot the blue XP bar kept cycling and after 3 mins there was no boot.
Powered off and the result was Ntldr missing.

Computer was a brand new Toshiba Tecra Notebook and had been running perfectly in an office environment for a week.  Standard Ghost image and this was about the 400th Notebook released to an employee.. NTFS partition,  Fully up to date with patches except SP2, protected by Sophos AV and TrendMicro firewall on the Wan.

On examination there were no bootable partitions available and suspected corrupted hard disc.. Ran Spinrite V6 at level 2, passed perfectly, then the higher level again passed perfectly. Assumed no hard disc failure.

Then booted Windows XP Recovery Console from CD.  and found no directories on the C: drive.. Then executed Fixboot and Fixmbr to the  boot record from Recovery Console, exited and rebooted... Windows XP started to reboot but failed with the message "Lsass.exe Componets missing".  in Safemode the same message.

At this point I was suspecting Sasser virus so I trawled the Web and then using Recovery Console again could not find any of the suggested Virus exe files... but all of the known folders were now present..

So I expanded (copied) the Lsass.exe file from the Recovery console.  Still no further advanced. Same error

Then I booted again off the CD and ran Repair disc..  It finally stopped when it attempted to boot/start at the 39min mark with the same error "lsass.exe" missing, the same with Safe mode.. but would not allow me to continue because the setup had failed. When the Lsass.exe reports as missing and you click OK the system re-boots and keeps cycling through the same issues, setup attempts to restart at the 39 min mark.

I then put the hard disc into the cradle of our Master Imaging computer and chkdsk came up with scattered groups of 4 segment errors immediately.  Again suspected corrupted disc.. and because I had run Spinrite earlier I assumed the hard disc was physically OK but had been corrupted.

Because there was no data recovery involved I gave up on my quest to attempt tio find the cause and GHOST re-imaged the Notebook with our latest Win XP Pro image and all is now working perfectly.

After browsing the web this "mysterious" Lsass.exe issue with possibly no virus activity is common and the only fix is to reformat or re-image as in our case..

Lets hope there are some comments from the community...

Colin Martin (Australia)

Question by:colinm39
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 15

Expert Comment

ID: 12154442
Being through all of that, theres no chance it is a floppy, right?


LVL 40

Expert Comment

ID: 12154482
Check out the hotfix for XP in this article:;en-us;815319&Product=winxp

I would disconnect any devices you do not need to load in this machine first, and perhaps disable all USB devices in the BIOS until you get the system booting normally.

LVL 11

Expert Comment

ID: 12155062
It sounds as if the original image was OFFSET - meaning that instead of starting to write at first sector it had been shifted 4 bits.  That's probably the reason why at first no folders were visible.  Repairing the MBR corrected this so you could see them, but some windows files cannot be moved - they are specifically addressed.  That would explain the NTLDR and  Lsass.exe problems (even though they were there, Windows was looking in the wrong place based on the new address).  Reimaging evidently produced a correct transfer starting in the first sector!
Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

LVL 11

Accepted Solution

Paul S earned 250 total points
ID: 12155809
did you run "chkdsk /r" from recovery console. you can also run chkdsk and other cool tools from BartPE. read about it here:

Expert Comment

ID: 12167501
Yes, I think it is a MBR record problem. may you use format /mbr to fix it?

Expert Comment

ID: 12372738
To save a lot of time just reformat the hard drive

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Just about everyone has an old PC laying around.  Ask anyone in the IT industry, whether they are a professional or play in it as a hobby.  From outdated Desktops to cheap "throwaway" laptops, they are all around and not as hard to "fix up" as you m…
Windows 10 is here and for most admins this means frustration and challenges getting that first working Windows 10 image. As in my previous sysprep articles, I've put together a simple help guide to get you through this process. The aim is to achiev…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question