lsass.exe application error

Juliane, let's try one more thing. Since you can't pull up task manager….See if you can stop/kill iexplore.exe by following the instructions located here:

http://www.beyondlogic.org/solutions/proce…processutil.htm

Now,
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.

Delete the file AVSERVE.EXE from your WINDOWS directory

Is this the registry run key that was created ?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve.exe" = C:\WINDOWS\avserve.exe

Man, you sound just like Microsoft or Dell! I'm not annoyed, but Ax was working on my problem in detail, and I think we were on the right track. Giving me more programs to catch spyware isn't going to give me back my ability to access security settings! Jacee, I don't have the avserve file in my computer. I've searched for it and that is why it turned up in the logs. But no, I don't have the sasser worm. Something happened to my security database, probably due to a sloppy exit from 2 USB devices at the same time, or some other user error. If this were a viral problem, it's the most benign virus ever heard of, because nothing else has been touched on my machine. Can Ax come back? He/She was giving me specific direction in the area that might produce a solution. Thanks for taking the time to help me, I appreciate it.

Hey Juliane, I'd be happy to continue assisting you. Just to recap:

My last post:

There was nothing wrong with how you entered the command, but it does give us the reason that the command failed. The command failed because it was an invalid command, which should be something like esentutl /r edb from the %windir%\Security folder. You can try this if you want, but you'll need to type cd %windir%\security and press Enter first.

I have a few other things for you to try. If one doesn't work, please proceed to the next. I believe the security policy issue and the system restore issue are related.

• Follow the instructions here for restoring the system restore tab, if this doesn't resolve the issue, move to step 2
• Follow the instructions here to recreate the local group policy file, if this doesn't work, move to step 3
• Follow the instructions here to reset the security settings to default

Please let me know the outcome of these instructions and whether any of them resolve the issue.

Regards,

Ax

Your response:

Could you tell me where to find the "root" folder? In C, there is no Root folder shown. I have all folders showing and have disabled simple file sharing. I looked in System 32 and System, no "root." I have CatRoot (2 of those).

You are right, I have no System Restore tab in C Properties. How does this happen anyway?

Could you give me exact instructions on the command prompt above? With the right command? I could try that first. The other instructions look as though I will need to back up the computer before I follow them. I do have a back up but not the system volume information as Windows wouldn't back that up for me.

"C" is the root folder. The root folder is the folder that contains all other folders (your 'C' drive). You shouldn't have to back up your system with the other instructions, but yes we can work through them one at a time. Please refresh your memory of our dialog by reviewing this thread and we can proceed, while addressing your questions as well.

Regards,

Ax

Hi again Ax, and thanks for coming back! I did the first step to try and restore my System Restore tab. I started the service in the Services admin controls. But there is no tab in C Properties. Here is the second step - should I go ahead and do this? I don't think I have any security logs since I deleted them in a previous attempt to repair. These instructions seem to apply to Windows 2000 - are they OK for XP Pro? I also don't think I have a SystemRoot folder, but I can look for it. ————————————————————————————————————————- To resolve this issue, use the procedure described in this section to re-create the local Group Policy file. Important Implementing a security template on a domain controller may change the settings of the Default Domain Controller Policy or Default Domain Policy. The applied template may overwrite permissions on new files, registry keys and system services created by other programs. Restoring these policies might be necessary after applying a security template. Before performing these steps on a domain controller, create a backup of the SYSVOL share. Note When you use the following procedure, your computer is returned to the original installation state where the Local Security Policy is not defined. You may have to start your computer in Safe mode to rename or move files. For additional information about how to do this, see Windows 2000 Help. 1. Open the %SystemRoot%\Security folder, create a new folder, and then name it "OldSecurity". 2. Move all of the files ending in .log from the %SystemRoot%\Security folder to the OldSecurity folder. 3. Find the Secedit.sdb file in the %SystemRoot%\Security\Database folder, and then rename this file to "Secedit.old". 4. Click Start, click Run, type mmc, and then click OK. 5. Click Console, click Add/Remove Snap-in, and then add the Security and Configuration snap-in. 6. Right-click Security and Configuration and Analysis, and then click Open Database. 7. Browse to the %SystemRoot%\Security\Database folder, type Secedit.sdb in the File name box, and then click Open. 8. When you are prompted to import a template, click Setup Security.inf, and then click Open. Note If you receive an "Access denied" message, you can safely ignore it.

Juliane,

You're welcome, only glad to help.

Yes you can go ahead with the second step, it can apply to XP as well.

It's %SystemRoot%, not SystemRoot. %SystemRoot% is an environmental variable that can be used to get to the system files. You need to be in the run command window or at a command prompt to use it.

For example, if I enter %SystemRoot%\Security in the run command, it opens my C:\WINDOWS\Security folder.

I got all the way through those steps and then…"Import Failed." Arrrrgggghhhh!!!!! I guess I have to go back and rename my secedit.sdb back to what it was instead of Secedit.old? I didn't have any log files to delete because they were already delted in a previous step. Sigh…..

Just checking in with you to see if you have everything back online and are ready to move to the next option.

Should I go ahead with this process: The last of your steps above. I was a little worried that things might get worse, but tell me what you think about the recommendations and the chance that it will work. Nothing else has worked so far.
SUMMARY
This step-by-step article describes how to set the security settings in Microsoft Windows XP Professional back to the default settings for a disaster recovery scenario. You should should only follow these steps when a security change has been applied to the computer that has negative affects and when no backup is available to restore from. The Secsetup.inf template does not contain a full copy of the security settings that are applied during setup.
Back to the top

MORE INFORMATION
Sample command to reset security settings
Note After security settings are applied, you cannot undo the changes without restoring from a backup. If you are uncertain about resetting your security settings back to the default security settings, you must make a complete backup that includes the "System State" (the registry files). Items that are reset include NTFS file system files and folders, the registry, policies, services, privilege rights, and group membership.

To reset your operating system back to original installation default security settings: 1. Click Start, click Run, type cmd, and then press ENTER.
2. Type secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose, and then press ENTER. You receive a "Task is completed" message, and a warning message that something could not be done. You can safely ignore this message. For more information about this message, view the %windir%\Security\Logs\Scesrv.log file.

Can you explain the step below to me once more, please? I think we never did quite get to the bottom of why this process didn't work. If you tell me the right command, we might be able to get more information.

There was nothing wrong with how you entered the command, but it does give us the reason that the command failed. The command failed because it was an invalid command, which should be something like esentutl /r edb from the %windir%\Security folder. You can try this if you want, but you'll need to type cd %windir%\security and press Enter first.

Juliane,

Sorry for my previous poor instructions, I was being hasty. Let me put them more clearly:

• Go to Start|Run, type cmd and press Enter
• Type cd %windir%\Security and press Enter
• Type esentutl /r edb and press Enter

As far as the next step goes, you've got nothing else to lose. I've ran the command before and it takes a while. If it doesn't fix the issues, I'm sure it probably won't create a bigger mess than you are in already ;).

Ax

Microsoft Windows XP [Version 5.1.2600] © Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\ab1>cd %windir%\Security C:\WINXPPRO\security>esentutl /r edb Microsoft® Windows™ Database Utilities Version 5.1 Copyright © Microsoft Corporation. All Rights Reserved. Initiating RECOVERY mode… Logfile base name: edb Log files: System files: Performing soft recovery… Operation terminated with error -528 (JET_errMissingLogFile, Current log file mi ssing) after 0.31 seconds. C:\WINXPPRO\security> —————————————————————————————————————————– I can restore the previous log files, I think they are still in my recycling bin. Is that what's missing?

You can try it if you want but if the esentutl /p command you invoked earlier worked, those log files should no longer be valid.

Okay, then, I guess my next attempt should be the re-set of the security settings back to a default one? That won't lock me out of my computer, will it? That would be my only concern - that I would re-boot and find that I needed a password or something that wasn't ever set… Thanks, thanks, a million times thanks!

You shouldn't have any problems like that, you're welcome.

Can this topic be closed now?

Can I have another day or so to finish taking all the measures that were given to me? I was on jury duty all last week and didn't get a chance to work on the problem. Thanks. Juliane