lsass.exe...

[Iwannabeapilot]

Hi there

I'm having problems with "lsass.exe". When windows starts, I get an error message saying:

C:\WINDOWS\system32\uvavbvc\lsass.exe

Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

And following this:

Could not load or run 'C:\WINDOWS\system32\uvabvc\lsass.exe' specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry.

I've checked the system32\uvabvc directory and 'lsass.exe' is there. I've done a full scan for spyware and viruses and cleaned the ones that were found, but this hasn't solved it. I've done some searching around and found lsass.exe is an important system file so I'm reluctant to remove it from the registry. I would have tried restoring back to an earlier time if system restore was activated  ::).

I'd appreciate any help.

[WebbPA]

Is there any instance of lsass.exe running?  There should only be one and this one is in the wrong place (should be C:\WINDOWS\system32\lsass.exe).

[Iwannabeapilot]

Is there any instance of lsass.exe running?  There should only be one and this one is in the wrong place (should be C:\WINDOWS\system32\lsass.exe).

Yes there is one running. As for it being in the wrong place, how would I go about fixing that? (if it's possible to fix)

[WebbPA]

Check the \system32 directory and make sure the file is there.  If not you can copy it from Windows\ServicePackFiles\i386.  You might want to compare file sizes, versions, signatures, etc. against the uvavbvc version.  If they don't match that's a sign that you have a rogue file.

Confirm that the "good" version is running and the "bad" one isn't started at all - I'm warning you because disabling the good one may prevent Windows from booting.  You should be OK because it looks like the good one is running and the bad one isn't, as evidenced by the error message.  Run msconfig and click on the Startup tab.

Make a note of where the bad one is called from.  It should be something like HKLM\Software\Microsoft\Windows\CurrentVersion\Run, Run- or RunOnce.

In the Startup tab uncheck uvavbvc\lsass.exe, cross your fingers and and reboot.  Once you reboot tell MSConfig not to send you the warning message any more.

At this point you have disabled Windows'  looking for this file at startup so you can back up and remove it.

After a few more boots when you are sure everything is working make the change permanent.  Open RegEdit and delete the key you made note of earlier.

[Iwannabeapilot]

Right, this is what I get when I open up msconfig:



I'm guessing that the one that's highlighted is the good one? Just a bit confusing since there's three of 'em listed here...

[WebbPA]

Windows starts lssas.exe as a service.  I have one version running which is started by the protected storage service but temporarily disabling it and turning it off didn't affect the ability to boot.  The Net Logon service may start a separate instance but I have that service on manual and I've never seen it running.  Windows doesn't need anything in the startup tab related to lssas.exe.  It would be in the services tab but the services tab doesn't give you the name of the process (like lsass.ese), just the name of the service (like Net Logon).

My first guess is that you have an unnecessary shortcut to this program in your startup folder:
C:\Documents and Settings\ProfileName\Start Menu\Programs\Startup.

Disable that one first.

Otherwise, it looks like one of your other startup programs is calling it - you have 2 CLIStart, one of which is probably superfluous and either one of which may be calling it.  Disable either one of these.

CLIStart is probably calling the Run key so disable the Load key.

You're probably going to need to do a little experimenting.

[Iwannabeapilot]

Superb!  8-) All is well again thanks alot for you help  :)

[WebbPA]

You're welcome.  Enjoy.