Windows XP Pro. Ntldr missing and wont boot. Also Lsass.exe issues

Symptoms were:

On Power on Boot the blue XP bar kept cycling and after 3 mins there was no boot.
Powered off and the result was Ntldr missing.

Computer was a brand new Toshiba Tecra Notebook and had been running perfectly in an office environment for a week.  Standard Ghost image and this was about the 400th Notebook released to an employee.. NTFS partition,  Fully up to date with patches except SP2, protected by Sophos AV and TrendMicro firewall on the Wan.

On examination there were no bootable partitions available and suspected corrupted hard disc.. Ran Spinrite V6 at level 2, passed perfectly, then the higher level again passed perfectly. Assumed no hard disc failure.

Then booted Windows XP Recovery Console from CD.  and found no directories on the C: drive.. Then executed Fixboot and Fixmbr to the  boot record from Recovery Console, exited and rebooted... Windows XP started to reboot but failed with the message "Lsass.exe Componets missing".  in Safemode the same message.

At this point I was suspecting Sasser virus so I trawled the Web and then using Recovery Console again could not find any of the suggested Virus exe files... but all of the known folders were now present..

So I expanded (copied) the Lsass.exe file from the Recovery console.  Still no further advanced. Same error

Then I booted again off the CD and ran Repair disc..  It finally stopped when it attempted to boot/start at the 39min mark with the same error "lsass.exe" missing, the same with Safe mode.. but would not allow me to continue because the setup had failed. When the Lsass.exe reports as missing and you click OK the system re-boots and keeps cycling through the same issues, setup attempts to restart at the 39 min mark.

I then put the hard disc into the cradle of our Master Imaging computer and chkdsk came up with scattered groups of 4 segment errors immediately.  Again suspected corrupted disc.. and because I had run Spinrite earlier I assumed the hard disc was physically OK but had been corrupted.

Because there was no data recovery involved I gave up on my quest to attempt tio find the cause and GHOST re-imaged the Notebook with our latest Win XP Pro image and all is now working perfectly.

After browsing the web this "mysterious" Lsass.exe issue with possibly no virus activity is common and the only fix is to reformat or re-image as in our case..

Lets hope there are some comments from the community...

Colin Martin (Australia)

Who is Participating?
Paul SDesktop Support Manager / Network AdministratorCommented:
did you run "chkdsk /r" from recovery console. you can also run chkdsk and other cool tools from BartPE. read about it here:
Being through all of that, theres no chance it is a floppy, right?


Fatal_ExceptionSystems EngineerCommented:
Check out the hotfix for XP in this article:;en-us;815319&Product=winxp

I would disconnect any devices you do not need to load in this machine first, and perhaps disable all USB devices in the BIOS until you get the system booting normally.

Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

It sounds as if the original image was OFFSET - meaning that instead of starting to write at first sector it had been shifted 4 bits.  That's probably the reason why at first no folders were visible.  Repairing the MBR corrected this so you could see them, but some windows files cannot be moved - they are specifically addressed.  That would explain the NTLDR and  Lsass.exe problems (even though they were there, Windows was looking in the wrong place based on the new address).  Reimaging evidently produced a correct transfer starting in the first sector!
Yes, I think it is a MBR record problem. may you use format /mbr to fix it?
To save a lot of time just reformat the hard drive
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.