This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Error massage saing c\windows\config\lsass.exe

53 min read

This thread's last reply is from August 10, 2009, 7:25 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

jmw3
July 16, 2009, 1:38 AM UTC
Hi
We'll try the Recovery Console again with a different command.
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter
  • At the C:\Windows prompt, type the following bolded text, and press Enter:
cd erdnt\hiv-backup

  • At the next prompt, type the following bolded text, and press Enter:
batch erdnt.con

  • The erunt backups will begin copying
  • At the next prompt, type the following bolded text, and press Enter:
exit

Windows will now begin loading.
Rasmus1112
July 17, 2009, 5:29 PM UTC
hi

there are still problems with the computer.
the computer is still restarts but this time I could see the desktop in 5 sec is a slightly more than before but there was no desktop icons and then it restardet. :(

is there more we can do and thank you because you still wants to help
jmw3
July 18, 2009, 1:55 AM UTC
Hi

Can you boot in to Safe Mode without the computer restarting?
Rasmus1112
July 18, 2009, 2:38 PM UTC
no its also restarting in safty mode
jmw3
July 18, 2009, 2:56 PM UTC
Hi

  • Reboot your computer & tap the f8 key (or f5 key) repeatedly until you see the Windows Advanced Options Menu
  • Using the arrow keys scroll down to Safe Mode with Command Prompt & press Enter
  • Login on your usual account
  • Type cd \ & press Enter (Note the space between cd & \)
  • Type cd \windows & press Enter
  • Type explorer.exe & press Enter

Let me know what happened.
Rasmus1112
July 18, 2009, 6:18 PM UTC
hi

its restarting and i cant see where to ride the commandoes..
do you think that my boot was wronge im not scure that i dit it right
jmw3
July 18, 2009, 7:02 PM UTC
Hi
What happened when you selected Safe Mode with Command Prompt? Do you get the option to choose a user account? When you choose your user account, did you get a black Command window or did it reboot again?
Rasmus1112
July 18, 2009, 7:09 PM UTC
hi

I selected Safe Mode with Command Prompt and the I got the option to choose among to users my normal and a administrator user..
Then I connected to my normal user after that it got to the normal think where its stands welcome and then I got a gimps of my desktop and I restarted again
jmw3
July 19, 2009, 12:57 PM UTC
Hi
Apologies for the late reply... hectic day.

We'll try the Recovery Console again with a different command.
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter
  • At the C:\Windows prompt, type the following bolded text, and press Enter:
delete C:\WINDOWS\system32\owjnfwb.dll

  • At the next prompt, type the following bolded text, and press Enter:
exit

Windows will now begin loading. Let me know what happens or any messages you may get.
Rasmus1112
July 19, 2009, 3:22 PM UTC
hi
It cannot find the file in the recovery consol..

File is missing system could not find the file ore something...
jmw3
July 20, 2009, 1:48 AM UTC
Hi
  • Reboot your computer & tap the f8 key (or f5 key) repeatedly until you see the Windows Advanced Options Menu
  • Using the arrow keys scroll down to Safe Mode with Command Prompt & press Enter
  • Login on your usual account
  • Type chkdsk /f & press Enter
  • Type Y & press Enter
  • Restart the computer

Let me know what happened.
jmw3
July 20, 2009, 4:56 AM UTC
Hi

Made a slight mistake on the syntax We'll try the Recovery Console again.
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter
  • At the C:\Windows prompt, type the following bolded text, and press Enter:
cd \windows\system32

  • At the next prompt, type the following bolded text, and press Enter:
ATTRIB -H owjnfwb.dll

  • At the next prompt, type the following bolded text, and press Enter:
DELETE owjnfwb.dll

  • At the next prompt, type the following bolded text, and press Enter: exit


Windows will now begin loading. Let me know what happens or any messages you may get.

If the above doesn't work try this:
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter
  • At the C:\Windows prompt, type the following bolded text, and press Enter:
chkdsk drive /p /r

  • At the next prompt, type the following bolded text, and press Enter: exit
Let me know what happens or any messages you may get.
Rasmus1112
July 20, 2009, 5:40 PM UTC
hi

In the first attempt with the system32 file.
There was no file of that name.

The second attempt with the chkdsk

There was nothing wrong..
I got a massage after the scan with the space there was spent on the C drive.

the computer was still restarting after the scan and all....
jmw3
July 21, 2009, 3:01 AM UTC
Hi
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter
  • At the C:\Windows prompt, type the following bolded text, and press Enter:
DISABLE CAERF

  • At the next prompt, type the following bolded text, and press Enter:
DISABLE RESTORE

  • At the next prompt, type the following bolded text, and press Enter:
CD C:\WINDOWS\CONFIG

  • At the next prompt, type the following bolded text, and press Enter:
REN LSASS.EXE LSASS.EXE.VIR

  • At the next prompt, type the following bolded text, and press Enter:
CD C:\WINDOWS\SYSTEM32\DRIVERS

  • At the next prompt, type the following bolded text, and press Enter:
REN RESTORE.SYS RESTORE.SYS.VIR

  • At the next prompt, type the following bolded text, and press Enter:
CD C:\WINDOWS\ERDNT

  • At the next prompt, type the following bolded text, and press Enter:
BATCH CFRECOVERY.BAT

  • At the next prompt, type the following bolded text, and press Enter:
BATCH CFUNDO.DAT (Ignore if there's any error messages)

  • At the next prompt, type the following bolded text, and press Enter:
CD C:\COMBOFIX

  • At the next prompt, type the following bolded text, and press Enter:
TYPE DREV.DAT (copy down on a piece of paper ALL that's displayed on screen)

  • At the next prompt, type the following bolded text, and press Enter:
TYPE SVCTARGET.DAT (copy down on a piece of paper ALL that's displayed on screen)

  • At the next prompt, type the following bolded text, and press Enter:
TYPE NDIS_LOG.DAT (copy down on a piece of paper ALL that's displayed on screen)

  • At the next prompt, type the following bolded text, and press Enter:
EXIT

Windows will now begin loading.
Let me know what happens & post the information where noted. If this doesn't work, don't do anything else until I get back to you.
Rasmus1112
July 23, 2009, 1:18 PM UTC
HI

When I was following your last posted I had some problems I have written the problems in blue so you can see them

* Restart your computer
* Before Windows loads, you will be prompted to choose which Operating System to start
* Use the up and down arrow key to select Microsoft Windows Recovery Console
* You must enter which Windows installation to log onto. Type 1 and press enter
* At the C:\Windows prompt, type the following bolded text, and press Enter:

DISABLE CAERF

* At the next prompt, type the following bolded text, and press Enter:

DISABLE RESTORE

* At the next prompt, type the following bolded text, and press Enter:

CD C:\WINDOWS\CONFIG

* At the next prompt, type the following bolded text, and press Enter:

REN LSASS.EXE LSASS.EXE.VIR (the system cannot find the file ore directory)

* At the next prompt, type the following bolded text, and press Enter:

CD C:\WINDOWS\SYSTEM32\DRIVERS

* At the next prompt, type the following bolded text, and press Enter:

REN RESTORE.SYS RESTORE.SYS.VIR (the system cannot find the file ore directory)

* At the next prompt, type the following bolded text, and press Enter:

CD C:\WINDOWS\ERDNT

* At the next prompt, type the following bolded text, and press Enter:

BATCH CFRECOVERY.BAT

* At the next prompt, type the following bolded text, and press Enter:

BATCH CFUNDO.DAT (Ignore if there's any error messages)

* At the next prompt, type the following bolded text, and press Enter:

CD C:\COMBOFIX (access is denied)

* At the next prompt, type the following bolded text, and press Enter:

TYPE DREV.DAT (copy down on a piece of paper ALL that's displayed on screen)

* At the next prompt, type the following bolded text, and press Enter:

TYPE SVCTARGET.DAT (copy down on a piece of paper ALL that's displayed on screen)

* At the next prompt, type the following bolded text, and press Enter:

TYPE NDIS_LOG.DAT (copy down on a piece of paper ALL that's displayed on screen)

* At the next prompt, type the following bolded text, and press Enter:

EXIT