lsass.exe - System Error

Hi, My laptop is running Windows XP Home. When I last booted it gave me the following error message: lsass.exe - System Error Security Accounts Manager initialization failed because of the following error: The handle is invalid, Error Status: 0xc0000008. Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information. I tried this and I get the same error no matter what mode I try to boot in. I tried to Boot to Directory Services Restore mode and got the same error. I also tried booting from the OS disk that came with the laptop. I ran it in Repair mode and it started to repair and reinstall components of Windows. However, it eventually came up with the same lsass.exe - System Error message and I cannot continue. How can I resolve this??? Thanks in advance, Jim

Please post a HJT Log over to the Malware Removal Forum.
http://forums.whatthetech.com/HijackThis_L…emoval_f27.html
We'll want to have them take a look to be sure that the lsass.exe problem is not of Malware origin.

If not we can resume here, but must check first please.

Best Regards

Thanks for your reply Doug. Unfortunately, since I cannot boot into "any" mode, I am not able to run HijackThis. This is a major part of my problem. When I try to boot using the OS system disk and select Repair, it requests an administrator password. I am the system administrator but it doesn't accept my password. It forces me to reboot and go through the cycle all over again. I don't know of a way to get past the password issue. Very frustrating! Any additional ideas? Thanks again.

IF this is the SASSER worm, and I agree with Doug's suspicions, that's what this looks like, please note this usually affects systems that are behind (way behind - :() in their updates. Microsoft Security Bulletin MS04-011, from 2004, addresses, and patched, the lsass vulnerability SASSER exploits.

To learn more about SASSER, TrendMicro put together a good White Paper on the topic.

Unfortunately, since I cannot boot into "any" mode, I am not able to run HijackThis. This is a major part of my problem.

Agreed. And that is not a good sign, especially since you tried to do a repair and it failed too. Normally, once a HJT log is called for, I step out of the way to let the analysts do their thing - but since this has digressed to where you can't boot into any mode, I'll toss in my 2 cents.

At this point, there are several concerns - with limited options. Do you have a recent backup of all your important documents, emails, contacts, etc.? Depending on the value you place on your personal data stored on the machine, and how comfortable you are with your technical skills, do not discount taking your laptop to a reputable repair shop - if nothing else, they will have the necessary test rigs (which most home users lack) and troubleshooting experience.

I tried to Boot to Directory Services Restore mode and got the same error.

Ummm, IIRC, this mode is for Windows based domain controllers - what is this laptop used for?

If this machine were to come across my bench the first thing I would do is pull the harddrive and connect it to a secure PC - then scan the heck out of it with all my security tools.