Lsass.exe System error after boot

[sWIGGUMs]

Hi, I am having trouble with a PC. He tried to install a new Gfx card and ram, all seemed to be going well until the software from the card was installed. Now, after boot I get the following error box;

lsass.exe - System Error
Indicates a revision number encountered or specified is not one known by the service. It may be a more recent revision than the service is aware of.

When i click ok the PC restarts, I have tried safe mode and still the error persists.
Any ideas?

 

[AlbertLionheart]

lsass is a windows security process associated with the user profile.
Have you created any new profiles?

 

[sWIGGUMs]

Nope, no new users. I've been doing some research into this, and as far as I can see Its a virus which is a mega pain.
Don't really want to wipe the HDD (who does) as its full of this guys files, programs etc...

 

[AlbertLionheart]

as it isn't your machine I guess you don't really know the history.
Back to the hardware install - could you replace the new kit with the original (if you have not done this already) and see what happens

 

[sWIGGUMs]

Yeh, I have removed the new gfx card and ram. Still the same error.
Do you think this could be a virus, or a problem with the software installed?

 

[AlbertLionheart]

It might be a driver issue for the gfx card - if you can boot into safe mode, go to device manager and remove all graphics card drivers.

 

[sWIGGUMs]

Unfortunatly booting in safe mode brings the same error. I cant seem to do anything, and of course there are no backups.

 

[dgower2]

In this situation (where booting in safe mode isn't feasible), you can create a bootable USB thumb drive with PE Builder and customize the PE with antivirus and antispyware plugins. This is a complex task that took someone I know several hours to do (for the first time), but it may be your answer. I know he used instructions from several websites to create it.

Would be excellent if there was a guide on Techspot to do this.

 

[CCT]

Since Safe Mode boot uses the MS vga.sys driver, the new drivers wouldn't be involved.

If the new card was OK before he added the new drivers, then the card is ok with vga.sys drivers.

Thus, the problem comes back to lsass.exe.

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050114-1706-99

 

[sWIGGUMs]

Can I run that symantec worm fix on an external drive. I could put the HDD in one of those caddy things and plug it into my test machine and scan the external.

 

[CCT]

Probably - I have never had to do it.

 

[AlbertLionheart]

Can I run that symantec worm fix on an external drive. I could put the HDD in one of those caddy things and plug it into my test machine and scan the external.

Good option - and back up the data while you are at it!

 

[sWIGGUMs]

Thanks for all your help so far...
Just trying the Symantec thing now.
Is there a way of using the SFC to scan an external HDD? Or does it just do the %systemroot%

 

[AlbertLionheart]

Not sure - I don't have a copy here but think you can with the latest edition.

 

[sWIGGUMs]

Just scanned it using that symantec and it found nothing. So I am back to square one. I am scanning it with AVG and Bitdefender but I am thinking the problem isnt a virus

 

[AlbertLionheart]

In my book the definitive on-line scanner is that found on the Kaspersky site at http://www.kaspersky.com/virusscanner - run this.
I think you are correct - this is not a virus or malware.
I think you may have to bite the bullett and do a reinstall - at least you have access to the files if it is connected to another PC - hopefully!

 

[CCT]

Exceeedingly strange behaviour.

Put it back in your original comp, boot to Bios, make sure boot order is floppy, dvd, HD, insert your Windows cd, press F10.

This should boot you to the windows cd - then try a repair install.

http://www.michaelstevenstech.com/XPrepairinstall.htm

 

[kimsland]

Or use TechSpot's guide
https://www.techspot.com/vb/topic8356.html

The title should be HOW TO PERFORM AN 'IN PLACE UPGRADE' / SYSTEM REPAIR

 

[sWIGGUMs]

The repair windows option does sound like a good idea, will I need the xp key for the version of XP installed. Also with a bit of scrounging I get the idea that no files, programs or anything user based will be lost, can you confirm this before I go ahead and press the big red button?
Thanks

 

[kimsland]

Yes you will definately need the key

You will lose all Windows security updates, that is all.

 

[sWIGGUMs]

Ok then. Next question.
There is no Key sticker on the case, can I use a program like the Magical Jellybean Keyfinder to find the Key on the HDD if I plug it into another PC or is there a boot disk that will do the same?

 

[kimsland]

Before Repairing you can use a program to view your current key, hang on I'll get the link !

Got it !

Keyfinder 1.06
http://majorgeeks.com/Keyfinder_Thing_Lite_d5253.html
License: Freeware
Requires: Win All

 

[sWIGGUMs]

Not sure if it posted my last message...
There is no XP Key located on the case, is there a program like the Magical Jellybean that can find the key on a non operational copy of XP (searching an external HDD). Or a program that will run on boot?

 

[kimsland]

Yes I answered you above

You need to refresh the page, when being this quick


we are now on page 2

 

[sWIGGUMs]

HAHA, yeh thanks!
Only prob being I cant get into windows to run this...
XP reboots after the loading screen. Dont see the login screen at all.