Lsass.exe error - XP laptop won't boot up

you will need to repair your windows XP installation.

boot up into the XP disk and choose repair when you have a list of your operating system on the screen

OK. But first I must tell you that a couple of days ago someone in a free online tech help forum recommended I do this:

http://pcsupport.about.com/od/operatingsystems/ss/instxprepair1.htm

(please note: Step 4 of this procedure is different than what you want me to do - I think)

I followed that through, but it didn't help. Here's what happened: it did the Repair process up to Step 8, after it completed Step 8 it said it would do a re-boot and continue on with the Setup. During the reboot, it gave 3 choices of OS's to boot from:

Microsoft Windows in C:\WINXP
Microsoft Windows Recovery Console
Microsoft Windows in C:\WINXP

(please note that before all this happened, I *did* have 2 OS's - the one I would always use was C:\WINXP. There was another one installed in C:\WINDOWS but that was corrupted from years before and I just left it there)

Anyway, the first one of the 3 above was automatically highlighed and it did the reboot using that. It proceeded to a sort of "blue screen" looking window that said "Setup is continuing", with progress dots following. After that screen it brought up a black screen with the cursor arrow in the middle. This looked good and I was expecting it to come up with the "Windows" logo and proceed, but it then quickly flashed a "blue screen" of some sort with a short message at the upper left which I did not have time to read, then it self re-booted again.
   Next time, I tried selecting the OS choice in the middle "Microsoft Windows Recovery Console", but this didn't get very far as it quickly gave a black screen message something about a file NTDRL or something. I rebooted again and chose the 3rd OS option (Microsoft Windows in C:\WINXP"), but this option just ultimately gave the LSASS.EXE error message again.

So what you are asking me to do here is different, I presume? I just now booted from my XP disc and it is at the blue "Windows XP Home Edition Setup - Welcome to Setup" screen. So do you want me to choose "To repair a Windows XP installation using Recovery Console, press R" ?

Thanks
    Shawn

Getsum - did you have a chance to read my reply?

Thanks
   Shawn

>>  lsass.exe  & Lsass.exe <<   that can be caused by a virus - connect the disk to another pc to scan it , or from a kaspersky cd : http://support.kaspersky.com/viruses/rescuedisk

in any case - BACKUP your data if needed FIRST
and on an older laptop - i would REINSTALL XP from fresh - that is the best solution

Thanks nobus. OK, I created the Kaspersky CD and am running it. It brought up a black screen that said:

ERROR: Unable to locate IOAPIC for GSI 4
ERROR: Unable to locate IOAPIC for GSI 6
ERROR: Unable to locate IOAPIC for GSI 3
ERROR: Unable to locate IOAPIC for GSI 7
ERROR: Unable to locate IOAPIC for GSI 13
ERROR: Unable to locate IOAPIC for GSI 8
ERROR: Unable to locate IOAPIC for GSI 1
ERROR: Unable to locate IOAPIC for GSI 12

Then it said:

>> Loading Modules"

..it loaded a bunch of them, then hung up on this:

: : Scanning for pata_qdi

... and it's been stuck there for the last 20 minutes. Any advice please?

Thanks!
    Shawn

well i found :   http://www.linuxquestions.org/questions/linux-newbie-8/error-unable-to-locate-ioapic-for-gsi-844609/
I think it lists interrupts 1, 8 12 and 13.... (i.e. if these are the USB controllers, check if you have USB connectivity).

also :  http://forums.fedoraforum.org/showthread.php?p=1426830
for thepata_qdi :  http://forums.gentoo.org/viewtopic-t-823338-start-0.html
http://forum.kaspersky.com/index.php?s=8262d823f47ee6390ef8394811fc8ff2&showtopic=215377

i hope it helps?

Thanks nobus - all the articles regarding the IOAPIC errors made no sense to me, I'm afraid. I'm going to need further help on that.

Regarding the pata_qdi problem, your suggestion at :

http://forum.kaspersky.com/index.php?s=8262d823f47ee6390ef8394811fc8ff2&showtopic=215377

... did seem to help. I followed these instructions:

1. In the start up wizard window, select the graphic interface language using the cursor moving keys. Click the ENTER button.
A window with various options will open.

2. Select the loading mode that you need.
3. Press the E key.
4. At the end of the first line after doscsi following a space insert noload=pata_qdi.
5. Press the CTRL+X keyboard shortcut.

... and it got past the error and did a lot of loading and initialization. Then it came up to a white screen with the END USER LICENSE AGREEMENT where at the bottom it says "press 'A' to accept the agreement, 'R' to reboot, 'P' to shut down the computer. I hit the A key, but nothing happens - I can just hear the CD drive whirring on, then it stops. I thought maybe it expects a capital letter 'A', so I put on CAPS LOCK and hit the A key, but no difference. I thought maybe it expects a carriage return after hitting the A key, but also no difference.
   So I have made *some* progress, but now I am stuck in a new place - on this 'End User License Agreement' !

Thanks
    Shawn

maybe the download was corrupt -try downloading again

OK, I got the Kaspersky working, I just did it in Text Mode. It found a couple of trojans and deleted them, but all this didn't help. When I reboot, I still have the Lsass error  :-(

What about what the 1st guy who responded to me said:

"you will need to repair your windows XP installation.
boot up into the XP disk and choose repair when you have a list of your operating system on the screen".

Can someone guide me through that? Would that help? I'm getting desperate here.

Shawn

no problem - you can do it thisway:
http://www.michaelstevenstech.com/XPrepairinstall.htm            Repair install  XP

I've already done this before and it didn't work (see my 2nd post at the top of this thread).

What is the difference between doing what you suggest, and using the "recovery Console"?

Recovery Console wouldn't work for me?

Thanks
   Shawn

well  i don't believe all you posted :  "the one I would always use was C:\WINXP " and you listed 2 of C:\Winxp ...
i always run a repair from the installation disk - i don't trust it from the disk itself - it's kinda like sawing the branch you're sitting on.. (it does work - but what if the disk has problems??)

Sorry for the confusion Nobus, I made a type in my post from earlier. I had typed:

Microsoft Windows in C:\WINXP
Microsoft Windows Recovery Console
Microsoft Windows in C:\WINXP

... and I meant to type:

Microsoft Windows in C:\WINDOWS
Microsoft Windows Recovery Console
Microsoft Windows in C:\WINXP

WINXP was the one that was working (the other WINDOWS one was non-operational).


Anyway, I tried the Repair Recovery or whatever it's called. It ran through the whole chkdsk /r (I had actually did a couple of these before I contacted you and they didn't help). It didn't do any good. Judging by that message I got last time:

""Windows could not start because the following file is missing or corrupt:

\WINXP\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM.
Select 'r' at the first screen to start repair."

... I was assuming that the "repair" process would allow me to selectively target the corrupted file and replace it with a fresh copy. Anyway, after I did it and rebooted (without the CD in), it came up to the choices of OS:

Microsoft Windows XP Home
Recovery Console
Microsoft Windows XP Home

.. the 1st one was highlighted and it quickly selected it and proceeded. Almost immediately it came up with:

"Windows could not start because the following file is missing or corrupt:
\WINXP\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM.
Select 'r' at the first screen to start repair."

... same as before. When I reboot again and quickly choose the 3rd option for OS, it takes me to a blue Windows XP window showing "Setup is being restarted...". Then it goes black and that same Lsass.exe error appears. Then it reboots automatically. I guess the Recovery Console or Repair is not gonna work eh?

Thanks
    Shawn

>>  WINXP\SYSTEM32\CONFIG\SYSTEM  <<  normal repair is as :
windows could not start because the following file is missing or corrupt:  \WINDOWS\SYSTEM32\CONFIG\SYSTEM
http://support.microsoft.com/kb/307545
----------------------------------------------------------------------------------------------
An easier way is to boot from a Bart PE CD (or UBCD4Win CD) and use the file manager for manipulating files. Here  the procedure :
1. rename c:\windows\system32\config\SYSTEM to c:\windows\system32\config\SYSTEM.bak
2. Navigate to the System Volume Information folder.
it contains some restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".
The restore points are in  folders starting with "RPx under this folder.
3. In such a folder, locate a Snapshot subfolder. This is an example of a folder path to the Snapshot folder:  C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot
4. From the Snapshot folder, copy the following file to the c:\windows\system32\config folder
 _REGISTRY_MACHINE_SYSTEM
5. Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
6. Exit Bart PE, reboot and test

Use a fairly recent restore point from at least a day or two prior to problem occurring .

** you can add the other hives also with this procedure

http://www.nu2.nu/pebuilder/       BARTPE
http://www.ubcd4win.com/            UBCD4WIN

Thanks nobus, I'll try that. But what do you mean by "the other hives"?

Thanks
   Shawn

in windows - you have  7 hives :   http://msdn.microsoft.com/en-us/library/windows/desktop/ms724877(v=vs.85).aspx

OK, so I may or may *not* need to fix those other 6 hives then?

So I don't need to follow the big procedure show at: http://support.microsoft.com/kb/307545 ?

Thanks
   Shawn

if it is not mentioned to do so - why ask if you should?
and YES you need to follow the procedure; the  cd solution is only for making navigating and renaming easier -but it's EXACTLY the same if you compare both

Thanks nobus, but I find your replies kind of confusing... I don't know why you said something like this:

"if it is not mentioned to do so - why ask if you should?"

...It sounds like you're mad at me or something.

Anyway, from the website http://support.microsoft.com/kb/307545, it mentions this Warning:

"Warning Do not use the procedure that is described in this article if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives. "

... my computer does indeed have an OEM-installed operating system. Do I still follow your instructions above for renaming the files while in a BartPE environment?

Thanks
   Shawn

Hi,
Normally that lsass.exe issues which are in the same conversation as "virus found" on system need the harddisk checking on another system as preferred option.
Would suggest you ensure that you are running Kapersky 2012 and do a full thorough scan on the laptop drive in question.
Had a number of root virus issues lately re similar errors occuring.
The main point I want to let you know is that by trying to repair the drive or scan it whilst it is running an OS itself, too many times a virus sneaks around the drive.
By phyiscally scanning the drive first via Kapersky (Norton and Mcaffee are not good enough to find the tdss type virus lately, you eliminate any program trying to jump across.
As soon as this is done once, would specifically recommend you scan again to double check the first scan (had wierd things happen re this).
If second scan confirms drive is 100% clear, then do a chkdsk (integrity scan via command prompt)
start, then run, the cmd
suggest you run the scan with following attiributes;
chkdsk x: /f /r
if the drive letter is called x: then select x - if d or e - select chkdsk e: /f /r
Microsoft Chkdsk link;
http://technet.microsoft.com/en-us/library/bb490876.aspx

If you can, it is usually preferred to do a scan via another pc, or if you have a spare hd use that to install windows, then use an external usb kit drive to view the suspect hd.

Let me know how you get on.
once in command prompt don't run any other programs or services, keep an eye on the drive scan

Thanks Andrew, well a few days ago I ran a Kaspersky rescue CD:

http://support.kaspersky.com/viruses/rescuedisk

... but this didn't help. I'm not sure what this Kaspersky 2012 is ... is that a free utility?

Also, I'm unsure what you mean about how to do the scan. I don't have a spare hard drive, but I do have another laptop. How do I utilize another laptop to do a scan on my crashed one?

Thanks
   Shawn

Kapersky 2012 - u have to buy it.
Get the full internet security and antivirus
Usually around £30-£40 uk
Invest in an external 2.5" laptop harddisk kit - let me know where you are can forward respective link.
Are you in the UK or US?

I'm in Canada actually Andrew. I'm really starting to think it isn't a virus, but rather just something (Registry?) that got corrupted. As I mentioned, on the advice of a free tech help forum, I already ran the Kaspersky recovery CD, and also OTLPE from a Bart PE environment CD. Didn't help. Maybe i should try that "hive" fixing procedure before going thru your suggested process? But regarding that "hive" process, it doesn't appear to apply to "OEM" Windows installations. Or would it still be ok?

Thanks
    Shawn

i'm not mad at anyone - i just try to make my answers as short as possible,so they are clear; that's all
may be time to use the restore to factory from compaq

So nobus, do you think I should still try to repair the hives manually, as you suggested? or because of my OEM installaton, I should not?

Thanks
   Shawn

Hi,
Will find a link for a 2.5" laptop usb harddisk external kit for you.

If you know how to (and be careful doing it) options as follows;

1 - depending upon what you need from the drive in the laptop in query either use a Bart CD/DVD, boot from that then plug in an external usb stick.
Scan through all the folders where you have any data, ie. documents and settings, then select the user accounts which you use, scan through via Bart explorer browser, find all the folders and files you need, if you use outlook or any software products specifically post it in the forum, might be able to advise how to backup the outlook data file (ie. pst file)
Copy itunes library, pictures, music, documents, any game save folders etc to an external usb drive.

Check the integrity of what you transfer, suggest copy in case anything goes wrong in data transfer.

2 - Leave the drive alone, buy a new laptop harddisk (depending upon sata or ide connector - ide type laptop harddisks in the UK are between 30-100% more expensive that a sata one, so check what part you would require.  figure that pricing must be similar in us/canada.
If you buy a spare drive, install windows on that spare drive, having swapped it with the one with your data one, (depending if you have the original media to install Windows etc and drivers - this option is then viable).
If you don't have the original media then goto option 3;

3 - obtain a 2.5" laptop harddisk kit, it is like an usb style connector, with a mounting for a 2.5" laptop harddisk, use the other laptop or pc you mentioned you have spare, take out the suspect drive, install it carefully into the caddy kit, virus check via fully tested and working laptop, before transferring any data, do a chkdsk on the drive, make sure drive sounds ok - no dodgy ticking or clunking!
Backup all data onto spare laptop, then return drive (no minus any critical data) to original laptop.
Do a complete system recovery and install clean version of windows - generally it is not worth the time trying to repair a system install - when registry gets as corrupt as it is, you will tend to throw a great deal of time tomorrow, next week, next month etc at lots of little or major problems.

By the way, if you happen to have a spare drive, or big enough usb stick, if you know how to use ghost, via Bart etc, make a full image to an external drive from the original faulty drive, I do that to make sure I don't loose any client data on the suspect harddisk if they won't either pay for a new harddisk or simply on  a budget.
My normal method in this situation would to ghost the drive anyway onto an external spare usb harddisk, verify the image, (check it is 100% ok), then format the old drive and reinstall via cd/dvd or recovery options, always check the data is intact before you format anything.

If the client has all media etc, ie. on a dvd or cd for windows, perhaps time is a factor to them, then I tend to supply a new replacement drive, install windows on that, reinstall all apps, software, drivers etc, recover what I can to a backup folder from the ghost image or old drive, then give the client the working pc with their old drive as a means of retaining the original system state prior to problem.
Client data is priceless - so rather than "loose" anything, I build the price of the drive to cover the costs.
That way if any file is missing, the client can at least access their data - not everyone will do this though, at the end of the day it is best to play it safe.
Let me know how you get on - will find a kit for the drive, though you can bypass that if you use Bart with a usb drive or memory stick big enough to transfer what you need.

FYI - you can make a registry backup also (from regedit), but if you start playing with the disk - better havbe a full image backup

Thanks for the input everybody... I just decided to do a full reformat and reinstall Windows. I had made a full backup about a week before it crashed anyway... and using the PE disc, I was able to save the current versions of my most crucial data to USB stick. So instead of continuing to waste yours and my time wrangling with the whole thing, i just bit the bullet. Sorry to waste all your time over this!

Can Andrew and Nobus share the points for their efforts?

Cheers
   Shawn

>>  Can Andrew and Nobus share the points for their efforts?   <<   yes - select multiple answers, then assign points to posts - BUT "the points for their efforts " is not good - it should be for solutions