Fixing windows lsass.exe boot problem through knoppix 4.0

[aggieforester05]

I have a compaq laptop with a 2.4ghz celeron processer and running windows xp home edition sp1. Recently my computer started getting alot of pop-ups so I did a system restore. After the system restore, my computer will no longer boot windows. after the windows xp screen pops up, my screen will go blank and my mouse will blink, then the computer would say there was a problem with lsass.exe, then it replaced that error message with this one "When trying to update the password, the return status indicates that the value provided for the current password is incorrect". Then it reboots itself everytime. If I try to run the recovery console, boot in safe mode or any other mode, or run the windows set up cd, it will reboot itself as well. The only way I have found to start it so far is to run knoppix 4.0 live cd, but my computer freezes whenever I try to delete file off of the hard drive or save any large files onto my usb drive. Does anyone know how I can fix my windows boot error through knoppix, or why my computer is freezing up when I try saving or deleting big files in knoppix? I have spent countless hours trying to fix this problem and any help would be greatly appreciated.

[Harry Kuhman]

... Does anyone know how I can fix my windows boot error through knoppix, or why my computer is freezing up when I try saving or deleting big files in knoppix?...

Until this current 5.0.1 release of Knoppix there were known to be data corruption problems if you wrote to a NTFS partition with Knoppix (even though some previous versions had software that supposedly could do it). Many of us, including myself, still don't trust that Knoppix can write to NTFS partitions safely. Your post only further increases my concern.

My best advice would be to use Knoppix to backup any files that you need and then do a complete reinstall of Windows. Be behind a router firewall when you do if you don't want reinfested almost instantly.

[ckamin]

aggieforester05:

Your description of your system's behavior would indicate that you have been seriously infected with a bug like "sasser". The key was the Win XP Home SP1. You should be running SP2 with all of the current updates. It should also be behind a router or other hardware firewall as Harry suggested and using an up-to-date antivirus program at the very least. There are many ways to recover the system, but the easiest would be to recover your files and then reformat the drive and reinstall windows.

A better choice to boot your system would be Windows PE or Bart PE. Bart PE is probably more available for most people. That would allow you to write to your NTFS partition without much risk.

I would suggest that you do a search on "lsass.exe" and look at Microsoft .com for information on that process also, to better understand what might have happened.