lsass.exe failed to initialize....

Hi there, and Happy New Year.

Powered up my old Gateway yesterday, and after seeing brief Windows logo screen, all went black, then the following messages... "lsass.exe failed to initialize properly. click ok to terminate". I clicked that, then got the same message for services.exe. clicked that and got the same two messages again, then nothing but a black screen with a "working" (movable) mouse pointer. Did a hard reboot a couple of times, but got the same result.

What's up with this thing??? Is this malware or system problems or what?

thanks for any help!
susan
(windows xp home sp2 running on pentium 3)

 

Most lsass.exe errors, when not malware related, are registry failures, speicifcally in the security hive.

If thats the case, then doing a repair will destroy your OS.

I'd first look into http://support.microsoft.com/kb/307545

 

OK, I did have to reinstall xp... all seems ok now.

Chaslang, you were right, btw. Was able to boot into Safe Mode, but got same black screen and error.

thanks all,
susan

 

I just dealt extensively with this problem, and I couldn't find a solution that didn't involve re-installing XP, so I thought I would post my final solution.

I was working on a system that was recently infected with the Vundo.trojan. The owner of the system said that after she ran CA and removed the malware her computer would no longer boot. She received the following error prior to the login screen: lsass.exe failed to initialize properly.

I booted the system with BartPE and opened regedit.
I imported the hive "C:\windows\system32\config\software"
I located the following key: Microsoft\Windows NT\CurrentVersion\Windows
I renamed the string value "AppInit_DLLs" to "AppInit_DLLs.old"
I created a new string value called "AppInit_DLLs" with no entries.
I then unloaded the registry hive and rebooted.

This technique does not require BartPE, any offline registry editing tool should work. Also remember to backup the original C:\windows\system32\config directory before making changes.

If the issue was caused by malware, remember to boot into safe mode or the malicious entries may be added back into the registry when you login.

Refer to the following for additional information:
http://support.microsoft.com/kb/256986 (registry information)
http://support.microsoft.com/kb/307545 (registry recovery)
http://www.nu2.nu/pebuilder/ (bartPE site)
http://windowsxp.mvps.org/peboot.htm (example of offline registry editing)
http://support.microsoft.com/kb/197571 (AppInit_Dlls Information)

I hope this helps someone else someday.

 

The regedit trick worked as I too just did battle against VUndo. I used The 'Ultimate Boot CD for Windows' and the 'remote registry edit' tool contained therein. Thank you...