TechSpot

Lsass.exe - operation failed

By surfersaiyan
Feb 20, 2009
Topic Status:
Not open for further replies.
  1. hi guys, its been a while but all's been sweet in the land of the saiyan! no tinkering, no problem!!

    until now..!!:suspiciou

    used the laptop last night, no probs. tried to start it this morning - "lsass.exe - operation failed" or something like that.

    i've had a quick look through a few forums & stuff, some reckon its a virus, some not.

    some recommend a full format, others suggest simply replacing the 'system' file in sys32 with the one from the recovery folder, have a look.

    http://www.computing.net/security/wwwboard/forum/16358.html

    i'm pretty much backed up so losing anything on my hard drive is not an issue.. i'd just rather not start pissing about with drivers and email settings, you know?

    the above fix is a cinch, but it seems to me that the file size in "windows\system32\config\system" is around 6MB but the one in "windows\repair\system" seems to only be around 1.5MB.

    so i suppose i'm asking if this is a legit fix or not.
     
  2. Tedster

    Tedster Techspot old timer..... Posts: 10,074   +13

    you could be infected by the sasser worm if your registry is not corrupted in a normal way.
     
  3. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    so...?? where to from here?

    are you there~ kimsland..?
     
  4. Route44

    Route44 TechSpot Ambassador Posts: 12,155   +34

    Go to the Virus & Malware removal forum and read the second and third sticky by Julio.
     
  5. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    thanx Route44.

    i'm pretty good with the virus & malware removal steps.

    only problem here is that the OS doesnt even start, so those steps wont do me any good until the computer actually boots up.

    i run SAS & MBAM fairly regularly and i'm not even sure this is a virus issue, but this is what i get..

    http://i32.tinypic.com/2ik6scp.jpg

    i had seen a relatively simple fix on the web and was really just wondering if its a worthwhile fix..

    http://www.computing.net/security/wwwboard/forum/16358.html

    it basically involves replacing the file named 'system' in sys32 with the one from the recovery folder.

    but since there is a discrepancy in file size, i wonder... hmmm
     
  6. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

  7. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    thanx Kimsland. another great post as usual. but i just couldnt get the command to work. i put it in as this:

    extract d:\i386\lsass.ex_ c:\windows\system32\lsass.exe

    but i was a little worried about the underscore after the first lsass.ex_

    and then a space before the c: ~but thats how you wrote it so thats how i typed it.

    but it came back with and unrecognised command, seemingly the 'extract' part.

    i then tried it without the word extract but that didnt work either. basically i tried a few things with the command line but it wouldnt work.

    so i'm gonna get the lsass.exe of my xp pro disk. put it on a usb and then boot into ubuntu and replace the apparently broken lsass.exe that way. thats how i fixed my partition magic calamity last time!!

    i'll post back and let you know how it goes.

    just for clarity, the purpose of this is to replace the original lsass.exe in system32 with a new one, isnt it?
     
  8. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

  9. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

    Yes Repair is an excellent idea

    Microsoft's Windows XP Professional Repair Install step by step
    http://www.windowsxpprofessional.windowsreinstall.com/sp2sp3installxpcdrepair/indexfullpage.htm

    Microsoft's Windows XP Home Repair Install step by step
    http://www.windowsxphome.windowsreinstall.com/sp2sp3installxpcdrepair/indexfullpage.htm

    -------------------------

    Microsoft's Windows XP Professional Repair Install step by step (* Including Delete Partition)
    http://www.windowsxpprofessional.windowsreinstall.com/sp2sp3installxpcdoldhdd/indexfullpage.htm

    Microsoft's Windows XP Home Repair Install step by step (* Including Delete Partition)
    http://www.windowsxphome.windowsreinstall.com/sp2sp3installxpcdoldhdd/indexfullpage.htm

    * Warning deleting the Partition will remove all User data and Windows system files

    -------------------------

    Vista Repair:
    http://www.windowsreinstall.com/winvista/index.htm (index page)
    http://vistahomepremium.windowsreinstall.com/repairstartup/repairstartup.htm (guide)
     
  10. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    ok, tried the repair install. no change.

    still getting the same message after the splash screen, "lsass.exe - operation failed" (http://i32.tinypic.com/2ik6scp.jpg).

    i will give the more complicated steps a try before i give up but if theres some way i can retrieve my email settings (*.iaf), emails (dbx) and address books (wab) then i'll be happy to just burn the mofo to the ground.

    any ideas?

    all my files are on an external drive but in my rookie-ness i didnt back up emails and email settings, D'ooH!!
     
  11. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

     
  12. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    thanx kim. i've printed out those instructions so i cant get em wrong!

    just in the meantime. if i were running xp pro on another computer and connected this [affected] drive to it as an external drive (via usb), would i be able to run outlook express from there?
     
  13. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

    No Outlook Express is not portable, meaning you cannot run it from another computer
    Although you can certainly backup your DBX files (ie Inbox.dbx) just do a search for all files and folders (including hidden and system files) for *.DBX

    The backed up DBX files can then be used to overwrite (ie remove) the present DBX files in the other computer, which will then allow you to open Outlook Express on the other cmputer, seeing your old Inbox.DBX file, as an example

    I hope that's clear
    Normally you use the Export function in a working Outlook Express computer to do all this manual work, automatically
     
  14. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    CRIKEY!! how many times can i say thanx!??

    actually i had a little win this afternoon.

    since i dont have another pc, i was using UBUNTU (live CD) to browse my broken windows. but for some reason ubuntu wouldnt find the dbx files.

    so i hopped on this afternoon with BackTrack3 and found the dbx files fine. also found the wab files too!! so i'm stoked to say the least. couldnt get the iaf files but i've got a workaround for that.

    once they are copied off safely somewhere else i'm just gonna open up a can of whup-*** on the unsuspecting lsass.exe!

    the weird thing was that on the day preceeding this failure i hadnt really gone to any dark places and the missus was the last to use it, and she only ever uses msn.jp... its got me well weirded-out!
     
  15. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

    It's just Windows normal corruption
    Not sure if you ever had a chance of running a full malware scan (possibly not) but that could have been it too

    I suspect you're now trying to backup, and re-install all fresh again, if so, this is possibly the best option.
     
  16. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    the way you wrote 'normal' is really scary. without backup, ppl could simply lose it all, and probably do, every day.

    i didnt have the chance to do the malware scan because even safe-mode wouldnt boot up. but i was still doing regular scans with SAS & MBAM.

    this is starting to get a bit old now (SORRY!) since i have a way of fixing it now..

    but actually, could i do the scans with the drive connected externally to a pc with SAS & MBAM? would it fix the rego?
     
  17. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

    It's worth a go :grinthumb I'd do it ;)

    By the way it's not that scary, 99% of faults are fixable.
    Really the only one that's bad is Harddrive fail.
     
  18. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    i also read something about a stand-alone utility from mcafee called 'stinger.'

    i'll give that a try too.. do you know anything about it?

    http://vil.nai.com/vil/stinger/
     
  19. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

  20. Squiggly1

    Squiggly1 TS Rookie Posts: 54

    Are you sure it's not Lssass with 4 s's? Lsass is a Nvidia display driver related file if I remember correctly. Lssass.exe is a worm file.
     
  21. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    not sure how many S's mate, but i doubt its a worm (could be tho!)

    actually this happened to me again the other day.. YOW!!:mad:

    but on this occasion i had been prudent enough to have saved copies of email accounts, address books, bookmarks and i was able to copy off the other files using linux (again, sigh) and had to re-open the can of whup-***!!

    so i formatted the drive and i'm back to square on, just running stuff on a daily basis. its almost easier these days, with the experience, to just reformat than fix. grr.

    i've gone a little further now and i'm not storing anything on C:\ that i can get away with.

    so i'm gonna give this a try...

    i bought this off ebay..

    http://cgi.ebay.com.au/Compact-Flas...ms=65:1|66:2|39:1|240:1318|301:1|293:1|294:50

    and i'm gonna buy this..

    http://cgi.ebay.com.au/ws/eBayISAPI.dll?ViewItem&ssPageName=STRK:MEWAX:IT&item=280354152707

    and i'm just gonna run windows from the 16GB CF card and store anything else externally.

    finally i just wonder if you think it might be anything to do with my version of windows. i use a stripped out version of XP i got from the internet called performance edition.

    basically its a stripped out version and doesnt have anything you dont need. you can check the latest version on torrentreactor here http://www.torrentreactor.net/torrents/2995070/Windows-XP-Performance-Edition-SP3-April-2009-V2

    ok.. i've blabbed on for far too long now but i'll post a separate thread about the flash hard drive.

    cheers, saiyan
     
  22. Route44

    Route44 TechSpot Ambassador Posts: 12,155   +34

    Kingston makes very good products. Keep us up-to-date on how it goes.
     
  23. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    LSASS.EXE AGAIN ~ YAARRGHHH!! this is like the third time this year with the same issue. its driving me insane because its really random. last night the computer was absolutely fine, this morning, error message ~ no startup. its starting to annoy me!

    so, where to from here? maybe a different copy of windows?

    so now my kingston arrived two days ago ~ so here we go!!
     
  24. Squiggly1

    Squiggly1 TS Rookie Posts: 54

    LSASS.EXE is a vital Windows program that you should not remove. It has to do with validating user passwords at startup, so viruses often attack this program or its .DLL files.
    When do you get this error message?
    Have you run a virus scan? Which anti-virus software(s)? See if that fixes it?
    Might be time to give C Cleaner a try.
    Or run System File Checker.
     
  25. surfersaiyan

    surfersaiyan TS Enthusiast Topic Starter Posts: 124

    thanx for the reply 'Squiggly'..

    the only problem with this particular error is that once i get the error message (http://i32.tinypic.com/2ik6scp.jpg) blah blah then the OS doesnt go any further and goes into a cycle of restart/error/restart.

    so i'm unable to get in to make any changes or repairs.

    i appreciate you taking the time and if you have any more on this i'd be super grateful!

    cheers, the saiyan!
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.