lsass.exe login problem

[Chrisnicw]

I ran into a problem this morning when i got on my computer.. WHen turned on and windows starts a dialog box appears stating lsass.exe-system fatal error. Object name not found.. As long as i dont click ok i can work but if i do it restarts. I've got win xp pro. Ive ran stinger from mcaffe, the actuall mcafee virus prog., and a norton program for the virus that some said cuased this. no viruses found. I went and tried to do a recovery and it says my h.d. was not found but yet it still loads and all? my h.d. is run through serial cable and it does work so at this point its the least of the two problems. Anyway to get rid of this? Thanks for the help.

[MAD_DOG]

Hello Snowy
If the lsass.exe is spelt with a capital L this is ok...if spelt all lower case this is a virus.
This has been around sometime and well noted on this forum

This is from the same family as W32.Sasser....... which has many relations

http://securityresponse.symantec.com
This free program gives details for removal of the latest viruses..

Make sure you have an up to date Virus program, in the future , (preferably paid for after initially using free version) to give you daily updates and occasional priority updates through the day

ie: programs like AVG, Adaware, Spybot etc
to protect you in future

[Chrisnicw]

I appreciate the response. It is spelled with all lowercase letters and I understand its been well noted about the virus. This site is where i got the free programs to check it.. I've already used the one you mentioned from norton, I've used a free mcafee scaner for that particular virus called stinger, and I've also searched with my paid version of Mcafee which is updated due to the automatic updates and my concern with staying virus free.. And still have not found any kind of virus especially the sasser or any form of it. Any other ideas? Thanks.

Oh and also have checked with spybot, adaware, trojan hunter, and spysweeper.

[Chrisnicw]

ok, well I take it no one has a clue what to do so I appreciate at least the one reply I got.

[gemini4]

Try a clean boot in safe mode: http://www.toughadmin.com/slideshow.php?article=Cleaning&i=2

Also is the lsass.exe message coming up in safe mode?

The Sasser buffer overflow shuts down the computer no matter what. In your case it looks that might be something wrong with the actual Local Security Authority Service.

Also try a system restore if the clean boot doesn't resolve the problem.

[Chrisnicw]

I can log on in safe mode with networking and the message does not pop up. Only in regular boot it does. I cant do system restore cause when i boot from the winxp cd, it doesnt seem to be able to find my hard drive. Thanks for the reply.

[MartyMcFly]

That whole L or l thing is wrong. Me and Mad Dog obviously google the same, and came up with this

http://www.hardwareanalysis.com/content/topic/28079/

This is where "Hey Snowy" comes from, a little too much copy and pasting.

Have a read of that, cos I haven't the time right now to do so, maybe will later.

[gemini4]

I can log on in safe mode with networking and the message does not pop up. Only in regular boot it does. I cant do system restore cause when i boot from the winxp cd, it doesnt seem to be able to find my hard drive. Thanks for the reply.

Did you do the msconfig process in safe mode?

If you did and you got the same results go back in safe mode w networking and do a trendmicro scan: http://housecall65.trendmicro.com/