Hey guys was reading tomshardware late last night, when my PC BSODed, on next boot up i got the error
Lsass.exe - System Error
An invalid parameter was passed to a service or function.
then you click ok, and system restarts and you get the error again etc etc
The general concensus seems from online forums seems to be that i need to reinstall windows to fix this problem, but this is only a 3 month old install, and i cant be buggered re-installign if i dont have to,
any ideas what the problem is and how to fix it?
also is it possible to do a system restore when you cant start windows?
Yes, try this first. This is a critical system process.
Sometimes, viruses hook this to ensure they load, even in safe mode.
Have you tried system restore from safe mode?
1) Boot your computer in safe mode.
2) Press 'No.' You can figure out the rest.
3) If that doesn't work, boot in safe mode again and press 'Yes'
4) Presst CTRL+SHIFT+ESC to load up task manager
5) Burn hijackthis to a CD
6) click "File\Run" in task manager and run hijackthis
6) look for anything suspicious and fix, else dump your log to the forums here and I'll check it out.
I should have said this in first post, but i have tried recovery console, and no love
i dont think its sasser worm, but i cant be sure atm as i havent reinstalled ZA yet. surely ZA would have stopped sasser worm though? i had it installed and up to date when the crash happened, also i dont know if this is related but the PC was running a virus scan when it BSODed (its set to run at 12.30pm every night ;p)
Also cant safe boot, or any other type of boot for that matter
Do a Repair install. XP cd in & boot to it. First Repair screen hit Enter. After F8 - the second Repair screen hit R. Do not boot to the cd on restarts.
After the Repair - get ZA up & running. Boot into Safe Mode and run a full scan.
ZA monitors registry & port activity. It doesn't stop viruses & worms coming in from user activity. Some of these things set themselves up in the Run Once key, and you're nailed before ZA installs itself upon bootup. The Sasser targets exe's - and can come in by a variety of ways.
Other worms & Trojans can actually disable an AV under certain circumstances.
Have done the sasser removal, no love there, i also ran zonealarm scan, nothing detected there either.
Also the error seems to be diferent from what most people who have had sasser worm get, so maybe its something diferent?
lsass.exe controlls the login/password part of windows start up right? so maybe a corrupt password file or something?
does anyone know if it is possible to use a system restore point without being able to boot into that copy of windows?
AFAIK, if you can't do it from the recovery console, and windows repair fails too, then you probably have to reinstall Windows.
I've been in such a situation...
Anyway, a full reinstall and configuration shouldn't take you more than 2 hours... i'm afraid by trying to repair it, you'll lose much more time instead
Have indeed allready spend more than 2 hours trying to fix ;p
but i think im close now, i have downloaded a bartPE with windows recovery cd on it, which should let me roll back a few system restore points, unfortunatly the trial version wont let me, so im just going to go eherm, "aquire" a full version from somewhere...
if that dont work then its time to install vista baby ;p
thanks to all those that have given help!
Just a quick update, i have my old windows instalation up and running per..well as perfectly as it was runnign before the error ;p
Ended up using a awesome program called bartPE in conjustion with windowsXP recovery CD maker.
makes a bootable CD that lets you roll back recovery points, run programs/virus scans etc etc,
awesome little program!
Thanks heaps for all the help guys(and girls?)