LSASS.EXE reposting machine

[Mainframeguy]

Whoa - I seem to have hit another wird problem on one of the machines I reformatted a month or two back.....

See the attached screenie - notice it is taken in SAFE MODE - now this error dialog pops up just as you would expect the Windows logon screen to come up (it is enabled).... and then if I click OK the machine goes back to POST!!

I can put in an XP CD and get to the Repair environment - and I have found LSASS.EXE in the i386 directory on the CD and it is way earlier than the one on the C: drive with totally different size - anyway not sure if I can copy from recovery console or what.....

Anyone out there help?

BTW I am aware this looks like Sasser, but trust me this machine was up to date with AV.... Anyway I would need to get to XP or somesuch to run the Sasser removal tool I guess? Or is there another way?

As an aside in desperation I tried a Knoppix bootable CD and that would not finish and get to run either! Does this indicate machine has died? Weird since I can see XP logo screen and "loading" progress bar and it was OK yesterday!

 

[Mainframeguy]

OH yes and I should also say that if I try an XP repair installation it copies the files - goes back and reposts for setup and then brings this file up again while it is trying to setup XP!

So looks like I am truly stuffed - anyone think of any other ideras before I reformat and loose the data?

(and yeah I know I could get drive out and put it elsewhere to try to get data!)

 

[Mainframeguy]

OK final bump on this thread - in a few hours time that drive is coming out for data delving and it is (I think) going to be the recipient of a complete reformat and re-install of XP-Pro, for it's sins.... If I had more time I would get a new drive - anyone have opinions on that? IE could the HD be going bad? It is approaching three years old and that machine has thrown up regular weird messages about replacing bad registry files and such-like....

Replies tonight of any kind much appreciated.....

 

[ep0niks]

It could be..

Try to run diagnostic software from manufacturer on it, it won't damage your data.

I had trouble back then, i plugged the hd into my main box and simply by running partition magic it solve the errors on the disk.

Also check your IDE cable.. sounds weird but i've been messing with a box for a couple hours to make the damn thing work, at the end i was desperate and i had some new cable around so i swapped them and.. TADAM

 

[Mainframeguy]

Just an update - that HD is now out and about to visit my secondary rig.... watch this space....

 

[onimkron]

I've never seen an error message like that before. Good luck with solving it- wish I could help

 

[Mainframeguy]

small update.... taken data off drive in second rig - drive appears good - but would love opinions on what to do with drive whilst it is out of the SMFF host where it had problems?

Chuck in bin and clone replacement?

Chuck and reformat virgin replacement?

Keep an low level format?

Keep an simple refomat/install?

as I say any advice welcome - this is a right b****r! (Pardon my French!)

 

[Mainframeguy]

OK - just bought Maxtor 160GB and it is formatting in there right now....

 

[Mainframeguy]

update - running a lot faster (added 256 SDRAM too!) and AOK so far - looks like bad HD!!

 

[Mainframeguy]

OK - time for thread to die - just finished all necessaries to restore HD and machin to active life - including copying all the original contents of bad HD across network to new one....

Presently running driveimage backup of new HD....

only one strange thing - seems the 160 GB Maxtor I bought is only recognised as a 120?

Weird, but irrelevant - I only bought that sive because the 40 GB drives thay had were at an outrageous price!.... also I have a flash USB drive thingummy = works fine, but not recognised by this machine (methinks it is a USB 1 issue?) Anyway have a USB 2 low profile card on order now, since I spent all this money and time to keep machine alive it better live wnough for the Winfast TV USB device I bought as a Christmas prezzie!

 

[bush dogg]

The 160G recognized as a 120 could be the bios needs updated.

My board will only recognize a 120G drive on the IDE with the bios I have but theres a bios update so it can see the full 160 (that I don't need because my drives or on a promise card and happy with that)

So might check for a bios update?

 

[Mainframeguy]

have latest BIOS - but thanks anyway ... like you say going from a 20GB drive it hardly matters about the missing 40 GB