Windows XP Pro. Ntldr missing and wont boot. Also Lsass.exe issues
Posted on 2004-09-26
On Power on Boot the blue XP bar kept cycling and after 3 mins there was no boot.
Powered off and the result was Ntldr missing.
Computer was a brand new Toshiba Tecra Notebook and had been running perfectly in an office environment for a week. Standard Ghost image and this was about the 400th Notebook released to an employee.. NTFS partition, Fully up to date with patches except SP2, protected by Sophos AV and TrendMicro firewall on the Wan.
On examination there were no bootable partitions available and suspected corrupted hard disc.. Ran Spinrite V6 at level 2, passed perfectly, then the higher level again passed perfectly. Assumed no hard disc failure.
Then booted Windows XP Recovery Console from CD. and found no directories on the C: drive.. Then executed Fixboot and Fixmbr to the boot record from Recovery Console, exited and rebooted... Windows XP started to reboot but failed with the message "Lsass.exe Componets missing". in Safemode the same message.
At this point I was suspecting Sasser virus so I trawled the Web and then using Recovery Console again could not find any of the suggested Virus exe files... but all of the known folders were now present..
So I expanded (copied) the Lsass.exe file from the Recovery console. Still no further advanced. Same error
Then I booted again off the CD and ran Repair disc.. It finally stopped when it attempted to boot/start at the 39min mark with the same error "lsass.exe" missing, the same with Safe mode.. but would not allow me to continue because the setup had failed. When the Lsass.exe reports as missing and you click OK the system re-boots and keeps cycling through the same issues, setup attempts to restart at the 39 min mark.
I then put the hard disc into the cradle of our Master Imaging computer and chkdsk came up with scattered groups of 4 segment errors immediately. Again suspected corrupted disc.. and because I had run Spinrite earlier I assumed the hard disc was physically OK but had been corrupted.
Because there was no data recovery involved I gave up on my quest to attempt tio find the cause and GHOST re-imaged the Notebook with our latest Win XP Pro image and all is now working perfectly.
After browsing the web this "mysterious" Lsass.exe issue with possibly no virus activity is common and the only fix is to reformat or re-image as in our case..
Lets hope there are some comments from the community...
Colin Martin (Australia)