Windows wont start

OK so this started in malware but TimW suggested it was now a software issue so is now being posted here.

http://forums.majorgeeks.com/showthread.php?p=1548236

Theres a link to original thread and what has been done so far. In a nutshell my laptop got the lsass.exe virus and when windows boots up and says lsass.exe error and then the screen goes black with just the cursor and thats it. Wont boot in safe mode and am writing this off mums laptop. Tried the kaspersky.ios to burn to a cd and try to get the laptop to read it by going into the BIOS and setting optical disk drive as the first option. It still didnt pick up the CD so then went into recovery console and tried fixboot and its currently 59% through chkdsk /r. Taking forever....

Any advice/help from here?

Adam

 

Greetings, Adam.

To clarify info gleaned from the Malware thread: you are set to boot from a CD/DVD, but with a verified bootable disk in the CD/DVD drive, the machine will not boot to that disk? By verified, I mean the disk will boot another machine.

As far as the chkdsk, depends on how large your hard drive is and how much data it contains. Maybe a quick rundown on your specs (both hardware and software) will help.

 

Yes that's pretty much what the problem is. The real problem is the lsass.exe error that won't let me get to the start up screen! So frustrating. I have a Sony vaio laptop and it's running on windows xp if that helps with anything. Please help.

 

Did the machine ever finish the chkdsk?

 

Yes. Nothing ever came of it though. What should it have done? I think the problem lies where I was doing a scan in one of the anti malware scans and the computer just crashed out. I read this messes up the registry? This is getting so frustrating now as there are files on the laptop that I need. thanks, adam

 

We really need to get this machine to a state where it can boot to a CD - what's the model #? And, do you have access to the USB ports?

 

Model # - pcg-7r2m

Windows xp media centre edition 2005 if that helps.

I have access to USB.

 

found a post here.

http://www.geekstogo.com/forum/topic/12548-lsassexe-error-on-startup/

thegorx user seems to have the answer as several pages in I read, everyone is giving him the props.

 

Only problem with this is, I dont know really know what any of that means. Im sure to someone like yourself all that sounds as easy as 1,2,3 but to me that sounds ridiculously hard. But i'll give it a go...

 

Ok so this is how bad my computing knowledge is. I just was reading through some threads of people who seem to be in same situation and realised the kaspersky.iso file i didnt write to cd as an image file. Once I done that it will now read it when I boot. It all started up ran the initial scan and it found some files and quarantined them but then I restarted and had my fingers crossed but went straight through and got the same lsass.exe failed to initialize error message.

So I'm going back in now to add c:, D: AND SDA1 to the scan to see if that makes any difference. I doubt it though. Is there anything else I can do with this new found knowledge (ie any other programs that may help).

Thanks

 

I mean at this point you have to consider trying that, or doing a reinstall of Windows. I would however only do it in the current directory and not a new partition or directory. I do not think it will erase your files and folders.

 

http://forums.majorgeeks.com/showthread.php?t=201397
http://forums.majorgeeks.com/showthread.php?t=201799

doing some research on the forum, this guy 'specialkman' seems to have the same problem and seems to be have got through it in a different way that seems understandable. Can someone maybe talk me through doing it this way?

 

doesnt the xp dvd have a repair windows option when you boot to it?
if you do a new install it will format the drive.

 

what xp dvd? I dont have the original windows cd that came with the laptop for some reason. Ive just downloaded ubuntu.iso file like the poster did in his thread and going to see if i can somehow toggle system restore to the last point using ubuntu. Does that seem logical? I wont lose any of my files if i system restore will I?

 

Ok so using ubuntu I have access to C: and D: Drives and all files and folders. This is good right. Any experts help me from here?

AustraAlien posted in that thread to try this...

Very early in this thread, you started out to follow TimW's suggestion "How to recover from a corrupt registry" by following the instructions in a Microsoft article. That's when I entered this adventure: I gave you the choice of several options and you selected to download and use the XP Recovery Console. That didn't work and we aborted the attempt.

I would like you now to attempt the same manouver using Ubuntu.
Basically, this is equivalent to performing a "System Restore" to the most recently created Restore Point, normally done from within Windows itself. It is called an "off-line" System Restore.

Step 1
Using Ubuntu, navigate to
C:\WINDOWS\system32\config directory.

Change the name of each of the following files, by adding .old to the end of the file-name.
default
sam
security
software
system

... so that they now look like this ...
default.old
sam.old
security.old
software.old
system.old
------------------------------

Step 2
Using Ubuntu, navigate to
C:\System Volume Information\_restore{long set of numbers & letters}\RPchoose the highest number\

and then
C:\System Volume Information\_restore{long set of numbers & letters}\RPchoose the highest number\snapshot directory

Copy each of the following files
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_.DEFAULT

and paste into the C:\WINDOWS\system32\config directory.
Now change the file-names, by removing "_REGISTRY_MACHINE_" (and in the case of "DEFAULT", remove the dot preceding "DEFAULT" so that the relevant files within the C:\WINDOWS\system32\config directory look like this
DEFAULT
SAM
SECURITY
SOFTWARE
SYSTEM
-----------------------

Now exit from Ubuntu and remove the CD from the drive bay.
Start your system normally. Does Windows load successfully?





Shall I try this???

 

ya if you can get to a system restore point.
it will not delete data files.
you may lose installed programes which were installed after the restore point was created.
thats even if you had system restore running at the time

 

OMG!! YEY! It worked, I did it and restarted and it took a couple of minutes but it loaded up to login page and im now in normal mode on my laptop!!!

Ok so what shall I do now, go back to Malware forum with TimW and see why it happened and try preventing it happening again?