lsass.exe infection on toshiba satellite a105-s2081

splinter-ink · Apr 29, 2009

Earlier today computer was working fine

rebooted and when through regular loading and after windows xp screen appeared the screen went black and the error lsass.exe appear saying to have started improperly...

we have tryied booting a safe mode and the error persists. the f8 button to access safe mode was nonoperational so we have been running of of "realtek boot agent" and CD-ROM Drive We can not access Task manager and thus not explorer.exe to access our virus scans/ removal tools.

it would be best not to have to wipe all of the data off the disk, data is not backed up....

any response at all would be great, we have looked at other help forums, but being amateurs and only knowing common sense stuff this is a pickle

thank you!

Corporal Punishment · May 2, 2009

lsass.exe handles most of the user log in stuff, so if it is corrupt or infected, you're going to have a tough time logging on.

If the file is loading from c:\windows\system32 it is probabaly legit and corrupt. - In that case I would boot off my windwos cd and recover the file from that.

If not - it is probabaly virus. You can try 2 things. Pull the drive and try and scan and clean it as a slave drive off another system. If that is unavailable try and run a restore point from the command prompt.

To do that, boot in safe mode command prompt
At the prompt type:
C:\windows\system32\restore\rstrui.exe

The follow the instructions to go to an earlier restore point.

If that gets you back into windows, you can run our suggested scans from there.

To do that.

Log in or Sign up

lsass.exe infection on toshiba satellite a105-s2081

splinter-ink Private E-2

Corporal Punishment Head of Software Shenanigans Staff Member