19 replies to this topic

[Nic731]

Hi, i think i have a big problem with my pc, (im on another on at the moment) whenever i turn it on it goes to a black screen after the bit saying windows xp then an error message comes up. At the top it says: lsass.exe - unable to locate component then underneath it it says: The application has failed to start because cyrpt.dll was not found. Re-installing this application may fix this problem. i have no diea what to do, iv tried restarting it, turning it off then on again from the mains but nothing works, please can someone help me?

[Doug]

Can you boot into SAFE Mode?

[Nic731]

im not sure, how do i do this?

[Doug]

ReStart your machine in the usual manner via START button - Select ShutDown - Select Restart After your machine shuts down and the screen goes blank/black, and then the machine begins to Re-Boot (turn itself on again).... Begin continuously tapping the F8 key on the top row of your Keyboard near the middle. During the boot sequence, you will be presented with a Display of Boot Options SAFE Mode Safe Mode with networking Safe Mode with command prompt Last know good configuration Normal boot (some other options may be there as well) Select - SAFE Mode When in SAFE Mode - Run your Antivirus Utility and allow it to Remove/Fix/Quarantine any items it finds. In later steps, we may need to "replace" the crypt.dll file, but please run your antivirus and report back before moving on to replacement of crypt.dll. This "may" be the SASSER virus, in which case we will be referring your over to Malware Removal Forum for full analysis and cleaning. However, it is "safe" to follow the recommendations above to run your onboard AntiVirus while in SAFE Mode, and may go a long way in solving this pesky problem. Please save the log of any changes your AntiVirus utility makes, and include that information in your next post here in this thread. Best Regards

[Nic731]

i tried that but even in safe mode i still get the message (by the way, after the message all i get is a black screen, so i never get any further than that)

[Doug]

Do you have your XP Installation CD? We may be able to "expand" the installation CD .cab to allow for copy/paste of the crypt.dll file into its correct location. Full instructions for doing the "expand and copy/paste" will be given in following posts. Right now just let us know if you do have the XP Installation CD. I'm assuming it is XP Home? Please confirm. If you do not have the Installation CD, for instance, your XP Operating System was "pre-installed", but your system "is" legitimate (has a MS Product Identification Sticker on the tower case), then you can perhaps borrow the appropriate XP Installation CD from a friend. A "borrowed" CD will be sufficient for our purposes here and would not be a copywrite violation to use in the manner that will be described in the following recommendations. I'll be getting back to you with additional recommendations after you reply about the XP CD. Best Regards

[Nic731]

i have the cd EDIT: yeah, its XP home

Edited by Nic731, 27 March 2007 - 11:09 AM.

[Doug]

OK. Please be patient for a few minutes, while I prepare to get back to you with additional recommendations. Best Regards

[Doug]

I've asked a Malware Expert to look in and follow along with this thread, but they will be unable to assist until you can at least get booted up and run a HJT.

So let's see if we can get that "crypt.dll" file replaced.

Here's good instructions from MS KB on the procedure to accomplish this task:
http://support.microsoft.com/kb/922371

Those instructions are for the "ntdsapi.dll" instead of for the "crypt.dll".

You can "substitute" the "crypt.dll" into those MS instructions to accomplish your task.

Please keep us advised of your progress, and ask any further questions as you proceed.

I think it "will" be a good idea to get a HJT Log posted over in Malware Removal, even if the above procedure appears to solve the problem.

That's because "something" had to be the original "cause" of the problem.
My suspicious tends to look at downloaded music, as the "crypt.dll" file is associated with MusicMatch and other MediaPlayer considerations when playing music media.

Best Regards

[Doug]

Instead of Holding the Shift key down to prevent the Windows Installation process from initiating, it may be necessary to do this work via Recovery Console.
Note To start the computer from the Windows XP CD-ROM, you must configure the basic input/output system (BIOS) of the computer to start from your CD-ROM drive.

To run the Recovery Console from the Windows XP startup disks or the Windows XP CD-ROM, follow these steps: 1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.

Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
3. If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console.
4. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.
5. At the command prompt, type the appropriate commands to diagnose and repair your Windows XP installation.

Read more on Recovery Console, here:
http://support.microsoft.com/kb/307654

Once you've entered recovery console you can follow the instructions to "expand" and "xcopy" the crypt.dll file as recommended in the previous reply above.

If worse comes to worse........ It is possible to use Recovery Console to do a "non-destructive" repair installation of the Windows Operating System.

Before you resort to Repair installation, please try the above "expand" and "xcopy" procedure.

More instruction and information is available about "non-destructive" reinstallation of the XP operating system.

Ask if you have questions.

Best Regards

[Nic731]

EDIT (AGAIN):im on the recovery console but when i dont know which cd drive it is, i have 2 but i dont know the letters of them, what should i do?

Edited by Nic731, 27 March 2007 - 12:45 PM.

[Doug]

Hi Nic731,

Working in Recovery Console and other "pre-windows" environments can seem "mysterious" sometimes, since Drive Lettering may change.

What I generally do is go to the most likely Drive letter and enter the command "dir" (without the quotes)
"dir" will read the disk at the Drive letter you entered and display a listing of the files and directories on that disk. Your Floppy (if any) is A: Your first hard drive is C:. If you have multiple partitions (D:, E:, F:, etc if it is a bid Hard Drive) those letters will follow. Then your Optical Drives will follow. So, working from the above example, the first Optical Drive (CD-ROM) would be G:, and second CD-ROM would be H:
Keep it simple by having the XP CD in one unit and no other CD's in any Optical Drive during this work.

If there is no disk at that Drive Letter, it will report something like - "No Media", or "Drive Empty"

The CD-ROM Drive that you want to be working from is the one containing your XP Installation.
when you enter "dir" and read the list, you will see the files and directories, listed alphabetically.
Read down the list, until you see the Directory Setup.exe <---- that will tell you that you've found the right Drive Letter to work from.

Here's additional information about functions that you can perform while running from Recovery Console.
http://support.microsoft.com/kb/314058
______________

If you have not yet begun the steps from the prior recommendations, then please do the following:
Run CHECKDISK, which will examine the "drive structure" for bad-sectors and bad-clusters.
It may just be that your "crypt.dll" is presently located in a bad-cluster. CHECKDISK will identify and attempt to recover the file and re-write it to another sector. If we're lucky, that could fix it up. If not, we'll have to go through the prior mentioned "expand" and "xcopy" from CD to get your crypt.dll back into System32 folder.

To Run CHECKDISK, enter the following at the command prompt:
:>chkdsk /f /r <---type only the bolded letters and forward slashes, and (note) the required spaces in front of each forward slash

edited to change "not" to "note"...... sorry, that was an important piece, please forgive the typo

Best Regards

Edited by dough, 27 March 2007 - 01:11 PM.

[Nic731]

i couldnt find the thing on dir anywhere and when i wrote chkdsk /f /r it didnt work (cant remember what it said) but i did it again but with chkdsk /p /r (i found this after googling my problem, thought it would probably be better asking though) and its doing something now, its on 69% buts seems to hav slowed down stopped, ill post again when it's done EDIT: i dont know whats going on but the counter seems to have started again, it says 51% now =/

Edited by Nic731, 27 March 2007 - 02:35 PM.

[Doug]

chkdsk /f /r is the command you should use. If you have more than one Hard Drive or Hard Drive partition, you can designate with Drive to check by inserting the drive letter, example follows: chkdsk C: /f /r

[Doug]

if your machine is already loaded to Windows and you try the chkdsk /f /r command from Start - Run - (type)chkdsk /f /r..............
Windows will throw an error message

"This type of Drive is file system NTFS or FAT32"
Cannot complete task because unable to get a lock on drive

Do you want to schedule chkdsk for the next time you reboot? y/n

That might be what happened.
That's fine, allow it to run next time you attempt to boot.

If the above is not the error message, and you continue to have difficulty, please provide specifics about the error message.

Best Regards