LSASS.EXE Error/Loop at Startup - Windows XP

I have a client who has a computer that is caught in a start-up loop using Windows XP on a Gateway 500s tower. At startup, I receive an error message dialog box which states the following and then reboots to a never ending loop...

"System error lsass.exe:
When trying to update a password the return status indicates that the value provided as the current password is not correct. "

I have used the Gateway OEM Operating System cd to attempt a repair by reinstall, tried a system console chkdsk /r however with no success.

I am uncertain to what the cause/resolution may be to work around matters. I also now notice the when attempting to access the system recovery console that a password is not required which I do not know making it somewhat impossible to use the console commands.

I am obviously trying to avoid a reinstall of Windows to a new directory (which would at least save the data) given that then I would most likely need to reinstall the applications as well.

Any ideas would be greatly appreciated. I have already checked here in this forum for possible solutions and am not finding much.

Mike

 

Are you sure that the program name is LSASS (capitals for clarity)?

Prior to SP2, a variant of the SASSER infection used the name ISASS (capital eye not el).

If it is an infection, on a working PC, download the Linux Avira Antivir Rescue system here

Once downloaded, insert a blank CD-R in the drive, double-click on the filename and follow the prompts to burn it. The file is about 50MB in size.

On the infected machine, boot from it and when the loading has finished, click on the flag/language of your choice, then Start Scanner. Depending upon your computer, the scan will take about 30 minutes.

Not all IDE/SATA/RAID controllers are supported, especially those on newer motherboards. You will know immediately if yours is not supported as there will be some screen corruption.

 

ISASS.EXE Error/Loop at Startup - Windows XP

Hi BurrWalnut,

Yes, you are correct - eye not an el

I have downloaded the program and will take it to the client's site within the next few days. I remain open to other ideas/solutions that may serve as alternative possible solutions to try if this is not the case.

Thanks !

Mike

 

As I suspected, you have caught ‘sasser’. If my memory serves me correctly, it’s easy to remove if you can boot but in your case you will have to try the Avira boot CD.

Google will tell you all about sasser. Also, there are other antimalware boot disks that can be downloaded if Avira doesn‘t pick it up.

On the subject of cunningly named programs/rogues, another is ctfmon, which is a process used by Microsoft Office. If the file is named cftmon, it is a Trojan.

Good luck.