# Black Screen after Windows XP logo and had a System error lsass.exe



## thrawn2143 (May 12, 2004)

Ok this is what happened. there was some error message whenever I was restarting my PC. Next thing I know is it boots up goes past the Win XP logo and its a black screen and nothing else.

Go into recovery console and did this as described

Part One
In part one, you start the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. When you have finished this procedure, a registry is created that you can use to start Windows XP. This registry was created and saved during the initial setup of Windows XP. Therefore any changes and settings that occurred after the Setup program was finished are lost.

To complete part one, follow these steps: 
Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer. 
Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted to do so. 
When the "Welcome to Setup" screen appears, press R to start the Recovery Console. 
If you have a dual-boot or multiple-boot computer, select the installation that you want to access from the Recovery Console. 
When you are prompted to do so, type the Administrator password. If the administrator password is blank, just press ENTER.
At the Recovery Console command prompt, type the following lines, pressing ENTER after you type each line:
md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

in the process of doing this restarted. Next thing I know I get this error message

System error lsass.exe:
When trying to update a password the return status indicates that the value provided as the current password is not correct. 

When trying to log into recovery console now I have a password on it and I dont know it

HELP!!!!


----------



## ~Candy~ (Jan 27, 2001)

Hi and welcome. From the sounds of it you have the sasser virus. Moving you to security forums.

You might have a read thru this:

http://forums.techguy.org/t226564.html


----------



## AVSupport (May 11, 2004)

You ahve to type in your Administrator password.......correctly....


----------



## thrawn2143 (May 12, 2004)

well the thing is this. Never had a password on it before


----------



## thrawn2143 (May 12, 2004)

My problem is I cannot get to a platform to upload either something to clean out a worm or to edit, delete, or add something. Since I cannot access the recovery console with this "new" password that I dont know what else can I do?


----------



## ~Candy~ (Jan 27, 2001)

Did you try safe mode?


----------



## thrawn2143 (May 12, 2004)

it comes up with the System error lsass.exe:
When trying to update a password the return status indicates that the value provided as the current password is not correct. 

in each safe mode


----------



## thrawn2143 (May 12, 2004)

so do u still think this is a security issue?


----------



## FinestRanger (Oct 13, 2003)

thrawn2143 said:


> it comes up with the System error lsass.exe:


sure sounds like Sasser.


----------



## thrawn2143 (May 12, 2004)

yeah thats whats been said. Only thing is how do U remove it if u cannot get into the recovery console or safe mode


----------



## ~Candy~ (Jan 27, 2001)

Hold on, I've asked someone else to take a look and I think we've stumped everyone here. Are you sure there isn't more to this story that you haven't told us?

Every bit helps.


----------



## thrawn2143 (May 12, 2004)

well lets see. 

when I ran the copy and replace bit the system file came up not found. so I went into the c:\windows\tmp\system.bak to replace the system file, since I did not have one avail in the c:\windows\repair\system (or it was the other way around)

At the time before that I could access the recovery console. since then I cannot get access. I ran the repair from xp install which gave me the access to see the error message and a cursor (where before I could not). but I cannot get to the desktop, safe mode, or recovery.

I need either something to reset that password or remove it. I guess


----------



## ~Candy~ (Jan 27, 2001)

Can you go back further, before you needed to restart the pc....what were you doing at that point?



thrawn2143 said:


> Ok this is what happened. there was some error message whenever I was restarting my PC. Next thing I know is it boots up goes past the Win XP logo and its a black screen and nothing else.


That quote is what I'm most worried about.


----------



## thrawn2143 (May 12, 2004)

it started off with when I started up from hibernation and there was an error message balloon in the corner something about a file in the system32. before that there was something involving my mail folder for MSN explorer. I powered down my pc and then all this started happening. I didnt catch what file it was with the error


----------



## ~Candy~ (Jan 27, 2001)

Well, if that's all we have to go on, my best suggestion would be to try a reinstall. Choose the option like you are going to start from clean, but at the second choice, choose the XP partition that exists. I think you'll probably need to reinstall apps, but your documents, etc. should be there.

Please wait for second opinions, but that is all I have to offer at this time.


----------



## thrawn2143 (May 12, 2004)

My biggest worry is losing what files I have, i.e. My documents and such. Cause if I use the disk do I not lose those files and such?


----------



## ~Candy~ (Jan 27, 2001)

I did an overinstall of XP twice, and did not lose files, photos, etc. However, the programs that I had installed, no longer worked, even though I could still "see" them via Explorer. I reinstalled the programs to the same directories and everything was left intact.

Your mileage may vary, but that worked for me


----------



## thrawn2143 (May 12, 2004)

so even though it say that you will lose these files u really wont?


----------



## ~Candy~ (Jan 27, 2001)

There are two options when you do a reinstall with the XP disk. I believe the second option is the one that gives you the choice to reinstall to the same partition/directory.

You can wait for second opinions as I don't have an XP machine in front of me to verify completely for you. I've been using XP on a test basis for about 8 months. I never register, and keep reinstalling every 30 days just to learn the procedures


----------



## thrawn2143 (May 12, 2004)

I see. well whenever I get to the menu it says reinstall (i got the OEM version that comes with my gateway) and it says I could lose my documents, ect. That is the main thing I do not wish to lose is the files, of course...


----------



## ~Candy~ (Jan 27, 2001)

Yes, I understand completely. I just can't remember if I saw that warning on the first page, or the follow up page. I really think I said ok to that one, then it gave me another option to install into the same directory.......but AGAIN, please wait. I don't want to be responsible for your loss of documents, etc. 

Actually, if no one replies, I can reinstall XP again tomorrow to verify. It's not a task that I like to do mid week, but it won't kill me.......feel free to post back or pm or email me.


----------



## thrawn2143 (May 12, 2004)

Yes that might help abit. I just seen how many people has read this thread. Thats crazy I get a problem like this


----------



## ~Candy~ (Jan 27, 2001)

Okey dokey, off to do my reinstall.....If I'm not back in less than an hour, send search and rescue and don't forget the beer


----------



## thrawn2143 (May 12, 2004)

cause of course my files are the main important thing not to lose (well my mp3 converter for Media Player too but that is a different story)


----------



## ~Candy~ (Jan 27, 2001)

Well, that was a treat 

I made it thru the install and my documents and shared folder were left intact.


----------



## thrawn2143 (May 12, 2004)

cool, thats what i needed to know


----------



## thrawn2143 (May 12, 2004)

yeah it says something like the my documents may be deleted and all.


----------



## ~Candy~ (Jan 27, 2001)

yep, I got the same message, but then I had a new document folder created today, with an extension on it......and the old one from before.

Just for fun, you might try a different user name this time, JUST IN CASE


----------



## thrawn2143 (May 12, 2004)

Now how do I get rid of the dual boot on here or is there a way to fix the original now that I have access again?


----------



## ~Candy~ (Jan 27, 2001)

Oh, crap, you shouldn't have a dual boot? Did you choose to install to the very same old installation? You should have had a choice showing you, and I think the choice was L to overwrite that last installation?

In any event, not a big problem, so don't panic, check to see if you can find all the files you were worried about?


----------



## thrawn2143 (May 12, 2004)

I did select L. Now I have a windows and a winnt folder. so it has a dual boot of the old one, which doesnt work, and the new one. Course I could probally fix the old one now that I have access to it, somewhat.


----------



## ~Candy~ (Jan 27, 2001)

Fixing the old one is harder than it would appear. Can we say, been there, tried that more than once 

Do you have access to the files that you were concerned about?

BTW, I'm testing some new memory, so if I disappear, don't be alarmed, I'll just be pulling my hair out along with the new memory


----------

