13 replies to this topic

[DUG_1]

"lsass.exe - Bad Image" "The application or DLL C:\WINDOWS\system32\LSASRV.dll is not a valid Windows image. Please check this against your installation diskette." This is the error I get when I try to boot my computer. After I get this error, I have to kill the power to get the compture to reboot. I have XPSP3 installed. I have tried "Last known good configuration", "Safe mode" ... and I keep getting the same message. This is a new personal laptop. (3 weeks old) I go through this forum and other to try to fix that but I have nt found, yet, the same case!.... Thanks a lot, Dug 18/08/2009

[Tomk]

Hi DUG_1,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

• Download DDS and save it to your desktop from
• Here
• here or
• here.
  
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
• We Need to check for Rootkits with RootRepeal
  
  • Download RootRepeal from one of the following locations and save it to your desktop.
    
    • Here
    • Here
    • or Here
  • Open on your desktop.
  • Click the tab.
  • Click the button.
  • In the Select Scan dialog, check
    
    
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt.
• Copy/paste the log (that you've previously saved to your desktop) from RootRepeal onto your post.
  
  
• Copy/paste the DDS.txt log (that you've previously saved to your desktop) onto your post.
  
  
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

[DUG_1]

Hi Tomk, Thanks for the reply! I do not have any access to the desktop of the computer, I guess that I will have to use a USB key with in it, the 2 softwares. But I have no idea how to run them from the USB key? Cheers, Dug

[Tomk]

DUG_1, You say your computer is 3 weeks old. Is it still under warranty?

[DUG_1]

Yes, it s under warranty ... but If I have the possibilty to sort it out without using the warranty, I would prefer. I have to check out the condition of the warranty, living in uk, I dont want to send back it to the US, mainly for the lead time! Cheers, Dug

[Tomk]

DUG_1,

Will your computer start in safe mode.

Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine,
amount of memory, hard drives installed etc (BOOT SCREEEN).
At this point you should gently tap the F8 key repeatedly until you are presented with a Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Tell me what happens.

[DUG_1]

I just boot in safe mode. The same message pop up, "Isass.exe - Bad Image"

[DUG_1]

When I press "enter", nothing happen. Just a black background with "safe mode" written in every corners.

[Tomk]

DUG_1,

I think your best bet is to do a repair install.

Microsoft provides information on how to do this in the following article:

http://support.micro...kb;en-us;315341

Let me know how it goes.

[DUG_1]

Ok, I will try that. I have a dvd with windows installation and the product key. My only concern is that I do not have any dvd player included in the computer (EEE pc). Can you confirm that plugging a external Dvd drive I will be able to start the dvd. The new external dvd drive will be used for the first time on this computer. Thanks for that. Dug

[Tomk]

DUG_1,

I'm not sure how the computer loads drivers for the external DVD if windows won't start.

I'm thinking we're getting in over my knowledge. I suggest that you post in the Windows forum and seek guidance from the Tech Team. I suspect they will know the proper hoops to jump through.

[DUG_1]

Got a good news, the laptop is back again, I bought the external Dvd drive, boot from the dvd, to reinstall everything. I do not have this error message when I start the computer anymore. A quick question, what free antivirus & firewall is reliable, > Avast? What are the first operation for a new laptop, I have created the first restore point. Thanks a lot anyway, Dug

[Tomk]

DUG_1,

Glad to hear things are working.

A happen to like Avast.

Here are some recommendations.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

[Tomk]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.