lsass.exe - system error / Object Name not found.
GRIZZ
user who is stumped. I have been working on this issue for 7 days (when I am
home from work). I have hit my head on the wall so many times that now I am
going to need some paint to cover the bloody circles. I have read over 200
posts from GOOGLE, MSKB, MajorGeeks, and about 50 others about solutions to
this problem; none of them have helped. This is going to be a LOOOOOONG
post, as I am going to provide as much information as possible with the hopes
that someone has survived this and can give me STEP-BY-STEP way to correct it.
Just so that you know, I have been running this system since 01/03/2006 with
the same load, the files in the C:\WINDOWS\REPAIR folder are dated then - I
am not going to use them...as I have 100's of applications on my machine that
have been installed since the install. I have SYMANTEC Internet Security
2008 (all updates - scans every Friday).
It all started last Friday (11 APR 2008). I rarely reboot my machine, but
overnight it had scanned my system, found something and I got up to a
::greyed:: desktop and a dialogue box telling me that my system was cleaned
and I needed to reboot. Only button was an [OK]. I clicked it and
Oingo-Boingo the machine began a reboot. When the system got almost to the
LOGON screen, another dialogur box popped up with the following
error/warning: lsass.exe - system error (and inside it Object Name not
found.). It had only the [OK] button to click. I could not get to the pass
word prompt to type in my password so I clicked [OK]. When I did the machine
rebooted. It came back to the same screen, and I "MOVED" the dialogue box
out of the way and tried to type in my password...no-go! Nothing was showing
in the box. I clicked [OK] again and the machine rebooted. Here is where
the nightmare begins. I went to the other room and got my laptop and set it
on the desk next to me to have a way to get to the Internet. Thinking I had
a virus, I searched on lsass.exe and virus.
It had about 12,450 hits. Boy O Boy, I thought...let's start reading. I
chose sites that I have used in the past to resolve other issues (I have my
own computer repair/consulting business) and each of them mentioned the
SASSER virus. I was never notified that I had a virus, but it is possible
that I got one. One of the pages talked about using the XP CD to go to the
recovery console. OK, I said...I'll give that a try first. I booted off my
slipstreamed SP2 XP PRO CD, and when prompted to enter my ADMINISTRATOR
password...I did. WHAMO-BLAMO, I am told the password is incorrect. Ok, I
know I am not crazy - when I setup/install any version of XP on any machine -
even ones that I do for customers, I always, ALWAYS use the same 10 character
password (letters and numbers) - it is my backdoor should I ever need to get
into the machine due to a corrupted user account. I checked, my CAPS LOCK
was not on. I typed it again, slowly; same response. I tried leaving it
blank, same response - but also told 3 incorrect password entries - press any
key to reboot. I did. Booted to the recovery console again, and tried the
password again in all caps, and mixed case (3 more times). OK, back to the
Internet. I then found a solution which used the REPAIR INSTALLATION option.
I was a little weary but tried it anyway (after I made FULL BACKUP of my C:
drive to and external HDD). I booted off XP CD, and went passed the REPAIR
USING RECOVERY CONSOLE option, and it found my installation of XP. I told it
to REPAIR it. It started the copying files and stuff, I went to the other
room, and came back to the GUI'ed screen asking for LOCALE settings (i.e.,
United States etc. - the first screen during and install where user input is
required). I followed the screens, input my PRODUCT KEY, and the
installation proceeded. I got to some point and the machine showed 39
minutes remaining. Then the lsass.exe box popped up. I screamed the "F"
word, and watched the HDD light stop, the CD light stop and let it sit for 15
minutes...the 39 minutes never changed. I took the plunge and clicked on
[OK]. The machine rebooted, and I was presented with the SETUP IS
CONTINUING.... screen when the machine rebooted (off the HDD). It showed the
same 39 minutes screen (the ads are cycling), and the lsass.exe window still
there. I again booted off the CD and tried to do a REPAIR install
again....it told me that one was in progress and it would continue it. Every
time I get the lsass.exe error.
I have also tried the RECOVERY CONSOLE off the XP CD, trying the RESTORE TO
LAST GOOD, the SYSTEM RESTORE (apparently all the restore points are
corrupted/contaminated as well).
OKAY. I said - let's dig harder. I got the Ultimate Boot CD for Windows as
referenced on another site, got it built on my laptop and tried it.
Meanwhile I had also installed a FRESH copy of Windows XP Pro onto another
partition on the whacked system (I have over 1TB of storage), and it does
boot & I can see the other Windows install on the C: drive. On the 2nd
install I chose NO PASSWORD for the ADMINISTRATOR account, and created a
DIFFERENT user name for the initial account.
I booted off the UBCD and it finds both of the Windows installs, and I can
see all the accounts on my ORIGINAL load. I tried all the REGISTRY
REPAIR/CLEANING tools, etc available to me on the UBCD. I still get the
lsass.exe error when I boot to the HDD and it is still trying to complete the
installation (stuck on the 39 minutes remaining).
So here we sit. I have BLANKED the passwords on the accounts from the
original install (using the UBCD option to do this). Still the RECOVERY
CONSOLE says my password is incorrect. The registry files have all been
cleaned/repaired/primed/painted/sanded/stained/gloss coated and waxed (hah
hah) using every tool that I can think of....but I cannot get passed the DAMN
lsass.exe error.
I really do not want to have to RELOAD this PC and put back all my software.
I do have a backup of the C: drive dated 12/10/2007 - but I have installed
many things since then, performed many tweaks etc., and I do not want to go
back that far.
So my question of MICROSOFT (or anyone), how do I correct this error - get
my system to let me back in (after it completes the INSTALLATION - or is
there a WAY to UNDO that?)? Can the INCOMPLETE installation be UNDONE - or
stopped?
Please HELP!!!
Sincerely,
Curtis
nass
"GRIZZ" wrote:
Hi Curt,
I feel your Pain!.
Did you scanned the HDD by hooking it up as slave to another machine with
all the horse power you got to scan for malware and viruses?.
You didn't elaborate on the what given you the message about something is
the Anti-virus or a system message? forgive me butt need to imagine the
scenario to live the moment.
You can rename the file Lsass.exe/Isass.exe by hooking the troublesome HDD
to another machine after scanning and locate these directory:
C:\windows\system32\lsass.exe
C:\windows\system32\dllcache\lsass.exe
Rename them to Isass.exe.OLD and Restart with troublesome HDD as A primary
(back as it was) boot option and see if it will boot up okay, any progress?.
Or you can copy the file Isass.exe from another machine to the same
directories:
C:\windows\system32
C:\windows\system32\dllcache
Reboot the HDD as primary or put it back in its case as Primary Drive
(change the jumper= sorry I need to confirm), are there is any difference?.
It is just a guess but did you hear about the WXY MBR Boot Virus that reside
on the MBR Boot sectors of the HDD, not easy to remove and a clean install is
the only option to get it OFF the machine.
HTH.
nass
---
http://www.nasstec.co.uk
GRIZZ
nass,
I have tried the RENAMING of lsass.exe to something else. DOES NOT WORK.
I coped the lsass.exe from the (2nd installed WORKING copy of XP). The
boot.ini file has the NON-WORKING version (C:\WINDOWS) and the WORKING
(E:\WINDOWS) versions listed.
If I boot to the WORKING version, I can see the C:\WINDOWS files and move,
delete, rename, etc. any of them - as they are not being used. If I boot to
the NON-WORKING version - it tries to COMPLETE the installation of XP (ontop
of what was there). It shows the lsass.exe ERROR and the background shows
the installation process at 39 minutes remaining. I have let it sit like
that for 4 hours and it never changes.
I wish I had never tried the REPAIR INSTALLATION process, as it appears
that I cannot BACK OUT of that. (I am sure there are files someplace that
Windows sees upon booting that kicks off the SETUP PROCESS (I just cannot
find them).
I mean, this should not be this hard. Every tool that I have tried will
show me the REGISTRY, show me the accounts that were on the OLD version of
Windows....but every damn time I think I have it fixed...the damn lsass.exe
issue comes back.
Any other suggestions???
nass
"GRIZZ" wrote:
You cannot log on or you experience a long delay on a domain controller or
on a member computer that is running Windows 2000, Windows XP, or Windows
Server 2003
http://support.microsoft.com/kb/883268
How to recover from a corrupted registry that prevents Windows XP from
starting
http://support.microsoft.com/?kbid=307545
What about restart the recovery Console and Fixboot and fixmbr commands as
here:
http://support.microsoft.com/kb/314058
I really can't see other option than clean install, did you test the HDD
health just to be sure the HDD is okay and intact!.
nass
"GRIZZ" wrote:
You cannot log on or you experience a long delay on a domain controller or
on a member computer that is running Windows 2000, Windows XP, or Windows
Server 2003
http://support.microsoft.com/kb/883268
How to recover from a corrupted registry that prevents Windows XP from
starting
http://support.microsoft.com/?kbid=307545
What about restart the recovery Console and Fixboot and fixmbr commands as
here:
http://support.microsoft.com/kb/314058
I really can't see other option than clean install, did you test the HDD
health just to be sure the HDD is okay and intact!.
GRIZZ
nass:
Thanks for your input. I have tried all 3 of those suggestions.
I KNOW IT HAS TO BE ABLE TO BE DONE!
All my files are there. If I boot from the UBCD, I can see the registry
files. I can load them, I can view them, I see all the USERS (Administrator
and my Regular User name).
The biggest thing now, is....and I know it has to be undoable.
I started the REPAIR (in-line) INSTALL. Someone has to know how to let XP
know that I want to try and boot the system with CONTINUING THE INSTALL.
There has to be a file (or files) that XP sees when booting which tells it
that it is donig an installation. Just have to figure out which one(s)
it/they are.
Someone out there knows how do do this...it is all about finding the
correct SEARCH tem to use in GOOGLE or someplace to find the instructions on
UNDOING AN INSTALLATION.
Many Thanks,
GRIZZ
GRIZZ
I have restored the HDD back to the point of BACKUP, but the two problems I
have still exist.
1) Upon booting, the "lsass.exe - system error / Object Name not found."
error pops up as soon as the XP logon/splash is gone. I still cannot get
into the registry with the RECOVERY CONSOLE - says PASSWORD INCORRECT. (I
have tried blanking the password with the UBCD - says that it took with no
errors, but still cannot get in).
2) After the XP splash screen shows, the lsass.exe error comes up and then
it starts the SETUP CONTINUING (from using the REPAIR option after booting
with the XP CD). It hangs at 39 minutes remaining, no CD activity and no HDD
activity. I have left it sitting like that overnight. There is nothing
attached to the computer at all (no printers, or other HW). There has to be
a way to get this to continue, or cancel out of it - so that I just get the
LOGON screen again.
NASS has provided some points, but nothing helps. I DO NOT WANT TO RELOAD
XP from scratch - I would have to re-load over 80 programs (that I use
constantly)
This all started when I cleaned a VIRUS off my machine and the clean process
had me DISABLE SYSTEM RESTORE (bah-bye restore points). When I prompted to
reboot - I got the lsass.exe error.
PLEASE SOMEONE HELP ME.
schac...@hotmail.com
- I have restored the HDD back to the point of BACKUP, but the two
problems I
- have still exist.
- 1) Upon booting, the "lsass.exe - system error /ObjectName not
found."
- error pops up as soon as the XP logon/splash is gone. I still
cannot get
- into the registry with the RECOVERY CONSOLE - says PASSWORD
INCORRECT. (I
- have tried blanking the password with the UBCD - says that it took
with no
- errors, but still cannot get in).
- 2) After the XP splash screen shows, thelsass.exe error comes up
and then
- it starts the SETUP CONTINUING (from using the REPAIR option after
booting
- with the XP CD). It hangs at 39 minutes remaining, no CD activity
and no HDD
- activity. I have left it sitting like that overnight. There is
nothing
- attached to the computer at all (no printers, or other HW). There
has to be
- a way to get this to continue, or cancel out of it - so that I just
get the
- LOGON screen again.
- NASS has provided some points, but nothing helps. I DO NOT WANT TO
RELOAD
- XP from scratch - I would have to re-load over 80 programs (that I
use
- constantly)
- This all started when I cleaned a VIRUS off my machine and the clean
process
- had me DISABLE SYSTEM RESTORE (bah-bye restore points). When I
prompted to
- reboot - I got thelsass.exe error.
- PLEASE SOMEONE HELP ME.
I have exactly the same problem and think its lame that no one can fix
this trivial
reistry fuck up , surely there must be a way to import default
administrator password
profile in the registry as the Recovery console like it. I must say
its have take my day off for
this , and the only thing i complissed was it starting with the
install program and then
as you said "Lsass error" pop up and the computer is restarted,, lol
Roftlmao , working with computers since 1982 , i think i will go linux
from now.
One simple miss using wrong cleaner program or maybe a manul edit in
keyregestry
should not have to totally make the install useless.!??????
For crying out load , isnt here any Registry gururs that can save us
the job on reinstalling
30-40 program applications , and aftert that , plugins , libraryed ,
paths , updates.. and so on .. ;o(
PLEASE HELP US
jeffostroff
Grizz, I had this exact same, problem, this is how I solved it in about
5 seconds:
1) When the Lsass.exe error dialog box pops up, hit ok, so that your PC
reboots.
2) Then when the very first Dell Bios screen or equivalent flashes up
on your screen, Press the F8 key when the operating system selection
page is displayed or before the computer starts Windows. This is the
same f8 operation you normally use when you want to choose Safe Mode,
only we are not going to choose Safe Mode.
3) The screen will now show several choices of how you want Windows to
load. Select the "Last Known Good Configuration" option.
My PC booted up instantly into windows with no problem. Went from
catastrophe to working perfectly in 5 seconds, the turnaround of all
turnarounds!
Forget all the nonsense you hear from other people about this being a
virus. Everyone blames everything on viruses. The only virus here is
Windows XP, and your registry most likely got slightly corrupted, so
this just reverts back to the last known working version. Stuff like
this happens a couple of times a year, I usually just boot of a system
cd, enter repair mode, run chkdsk /r to repair the disk, then reboot.
Only when I ran the F8 sequence I mentioned above after the chkdsk did
it work. Coincidentally, this whole problem started during a MacAfee
scan, which no bad files were found, so MacAfee could have been the
culprit. I’ve seen this happen before.
If you still experience the problem, follow these steps to log on to
the computer and to run Sc.exe at Microsoft’s tech support page
for this error:
http://support.microsoft.com/kb/883268.
Hope this helps!
Jeff
--
jeffostroff
------------------------------------------------------------------------
jeffostroff's Profile: http://forums.techarena.in/member.php?userid=47688
View this thread: http://forums.techarena.in/showthread.php?t=953091
GRIZZ
Appreciate your help. On a scale of 1 to 10 for computer experience...I
am a 9.987. I love Windows, and XP is by far the BEST F***ing OS that has
ever come out of MS. VISTA is the biggest JOKE ever.
I cannot believe that no-one on this big old planet has ever recovered
from this problem without having to reload. I gave up after 2 weeks of
constant fighting with the REGISTRY issues (using every sort of tool
available). I reloaded, and am still in the process of rebuilding. I know I
should have had a more recent backup - noone to blame there but me. You
would think with over 1.25TB of storage I could have done them more often.
:-)
I was not able to use the LAST KNOWN GOOD option. I tried it. It yeilded
the same results. One of the steps I was given to fix the issue was to turn
OFF SYSTEM RESTORE (I WILL NEVER DO THAT AGAIN), and then reboot to SAFE MODE
to remove the remaining virus files before booting off the CD to get the last
ones. Once all that was done...I got the lsass.exe error.
If ANYONE at MS is listening to us XP users, and trust me there are MORE
of us that VISTA users...I cannot believe that you guys cannot help someone
fix an issue with your OS such as the lsass.exe problems I had and about
25,000 other people according to posts on the Internet. GIVE IT UP, and come
out with a SP3 for XP and put VISTA in the TRASH HEAP like Millenium Edition.
I leave you with one final thought: "IF IT AIN'T BROKE, DON'T MESS WITH
IT". Newer is NOT always better.
I have a great deal of influence over my IT customers' decisions with
their computers...and I will never recommend one of them DOWNGRADE to VISTA.
"jeffostroff" wrote:
>
> Grizz, I had this exact same, problem, this is how I solved it in about
> 5 seconds:
>
> 1) When the Lsass.exe error dialog box pops up, hit ok, so that your PC
> reboots.
>
> 2) Then when the very first Dell Bios screen or equivalent flashes up
> on your screen, Press the F8 key when the operating system selection
> page is displayed or before the computer starts Windows. This is the
> same f8 operation you normally use when you want to choose Safe Mode,
> only we are not going to choose Safe Mode.
>
> 3) The screen will now show several choices of how you want Windows to
> load. Select the "Last Known Good Configuration" option.
>
> My PC booted up instantly into windows with no problem. Went from
> catastrophe to working perfectly in 5 seconds, the turnaround of all
> turnarounds!
>
> Forget all the nonsense you hear from other people about this being a
> virus. Everyone blames everything on viruses. The only virus here is
> Windows XP, and your registry most likely got slightly corrupted, so
> this just reverts back to the last known working version. Stuff like
> this happens a couple of times a year, I usually just boot of a system
> cd, enter repair mode, run chkdsk /r to repair the disk, then reboot.
> Only when I ran the F8 sequence I mentioned above after the chkdsk did
> it work. Coincidentally, this whole problem started during a MacAfee
> scan, which no bad files were found, so MacAfee could have been the
> culprit. I’ve seen this happen before.
>
> If you still experience the problem, follow these steps to log on to
> the computer and to run Sc.exe at Microsoft’s tech support page
1EyeTech
I've recently had this same problem. It's a Dell Dimension 4600; it's
been running more or less non-stop since 1/31/03.
My problem started when I attempted to upgrade Trend Micro Internet
Security 2008 to 2009.
The only difference I would point out for my situation is: I can boot
using the last known good configuration. And of course any tools I run
will find nothing wrong, because it's the -Last Know GOOD
Configuration-. I can *shut down* and *power on* fine. But if I try to
reboot/restart the lsass.exe system error appears.
I find it hard to believe that three separate incidents, involving
MacAfee, Norton AND Trend Micro, all being the catalyst for the same
problem. There must be some inherent "failure" within windows for this
to happen.
I will attempt the good config boot and chkdsk and hopefully that fixes
it, I would rather not have to do a fresh install on my system either.
Thanks for the help, it was very informative and the best solution I've
found thus far.
--1EyeTech
--
1EyeTech
------------------------------------------------------------------------
1EyeTech's Profile: http://forums.techarena.in/members/94968.htm
View this thread: http://forums.techarena.in/windows-xp-support/953091.htm
Bus Driver
What is LSASS.EXE?
lsass.exe is a process which is registered as a trojan. This Trojan allows
attackers to access your computer from remote locations, stealing passwords,
Internet banking and personal data. This process is a security risk and
should be removed from your system.
Other instances of LSASS.EXE:
1) lsass.exe is a process which is registered as a trojan. This Trojan
allows attackers to access your computer from remote locations, stealing
passwords, Internet banking and personal data. This process is a security
risk and should be removed from your system.
2) lsass.exe is registered as a downloader. This process usually comes
bundled with a virus or spyware and its main role is to do nothing other
than download other viruses/spyware to your computer. This process is a
security risk and should be removed from your system.
http://www.liutilities.com/products/wintaskspro/processlibrary/lsass/
Download from here
http://www.malwarebytes.org/ version 1.36 install and then boot into safe
mode and run the Program scanner
Hope this helps
Steve
"1EyeTech" <1EyeTec...@DoNotSpam.com> wrote in message
news:1EyeTec...@DoNotSpam.com...
1EyeTech
There is another possibility: *lsass.exe* is also the *-Local Security
Authentication Server-*. It's used by windows to create the login token
and allows users to log into the windows system.
It is possible (either from viruses or other means) that the lsass.exe
has become corrupt. One way you may be able to repair this file is to
boot into safe mode with command prompt and type *sfc /scannow*. This is
the *System File Checker* and it scans your protected windows files to
ensure that they are in their original state. If they're not they should
be replaced automatically by Windows.
A second option to try might be to use a Windows XP Pro disc (either
OEM or slipstreamed) and hit "r" while booting to get to the recovery
console.
Still trying the boot and scan disk. Hoping that fixes it as I can't
boot into _ANY_ version of safe mode.