[SOLVED] Hiren's cd fix for lsass NEEDED step by step

[AgentFoxx]

Hello, I need help with step by step instructions on how to use Hiren's cd to correct the lsass exe error.

This is what happened:
My system crashed, got blue screen error <windowsroot>\system32\hal.dll

I followed the MS instructions.... which created the new problem "lsass.exe, password not valid, reboot). I am running XP PRO, because of this error I can't boot up windows & I can't get into recovery console, don't have administrators password. I researched google and found Hiren's CD. Not sure exactly what to do from this point. I also found a possible solution on google:

Working Solution! - Without swapping HDD, re-installing windows or losing data.

This is what worked for me.

Requirements:
1) System Restore enabled in windows.
2) NTFS Dos Pro and a Boot CD/Disk - Preferabbly Hiren's Boot C (which is loaded with all the apps you need). Hiren's Boot CD (http://thanki.tk or torrentspy.com)
3) Don't use the system.bak file located in windows\repair.
4) Don't assume that either of the _regis~1, ~2, ~3 or ~4 files in a RP\Snapshot folder are the registry files you need - they are not.


Steps.
1) In your BIOS, set 1st boot device to CD.
2) Reboot with Hiren's Boot CD (or similar).
3) Load NTFS DOS Pro. (in the NTFS Ext2Fs Tools menu on the Hiren CD). You can skip Checkdisk
(use pro instead of regular NTFS as it lists long file name details)
4) Once loaded, the 2nd last line of text indicates the new temporary drive letter of your HDD, in my case D:
5) switch to D:
6)i) You will probably have short file and folder names displayed instead of long when you 'dir', however the full name appears once you are in the directory.
6ii) type (without quotes ' cd system~1\_restor~1\rp95\snapshot '
(RP = restore point, the higher the number the more recent the rp. if this doesn't work for you, try a lower/older number).
7)type ' dir/p ' to list the files in the directory. (use /p, not /w for this)
8) Look through the text (file details) on the right to find ' _REGISTRY_MACHINE_SYSTEM '. Look across to the left, this is the file size (which should be fairly large, eg 5,365,760 in my case). To the left again is the actual file name, in my case ' _r62e7~1 '.
9) You may need to tap the space bar again to finish listing all the files.
10) Once at the command prompt, type ' copy _r62e7~1 d:\windows\system32\config\system '
11) Overwrite = Y
12) Reboot (CTR+ALT+DEL)
13) Load windows.... sucessfully hopefully.

If this doesn't work for you, try;

A) Reload NTFS PRO, go back to the same RP\snapshot directory and copy the following files (copy the actual file name, not the details text).

_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_DEFAULT

copy (overwrite) the above files to their corresponding file in the config directory (step 10). eg _REGISTRY_MACHINE_SOFTARE copy over ' software '

Above are all the files that Microsoft recommends you overwrite..... however MS caused my lsass loop in the first place!

I have booted my system with Hiren's CD, Loaded NTFS DOS Pro. (in the NTFS Ext2Fs Tools menu on the Hiren CD). skipped Checkdisk,
I get lost at step 4. My system gave me these options: R: RAM DRIVE C: CDROM DRIVE B: FLOPPY

Not what is listed in the above instructions, I'm unclear as to what to do next. If anyone knows how to use the Hiren's CD to fix my problem PLEASE HELP
Thanks in advance AgentFoxx

[atavist]

ntfspro isn't seeing your hard drive. you probably have your drive on RAID or AHCI. in which case you won't be able to use Hiren.

[AgentFoxx]

Thanks atavist, this is what appeared on the screen after in loaded Ntfspro:
Mounting NTFS partition at 0x89:1 as drive d:
Going resident .....
C: CDROM Drive
R: Ram Drive
B: Floppy Drive
Type M for Menu

I don't have a floppy drive or a ram drive on my laptop, so what is going on, I don't have my hard drive on RAID OR ACHI. Is there other way I could use Hiren's cd tofix my computer. I got lsass exe. password error after following the fix on MS

Thanks Jazzi

[AgentFoxx]

Thanks to all that veiwed my problem.
I have figured everything out , I did use the Hiren's Boot Cd to repair the lsass exe. error on Windows XP Pro. My system is running perfectly now. I did'nt lose any files. The Hiren's Boot CD is a god send

The original instructions posted didn't quite work for me (see above post),you need to say yes to chkdsk and yes to mount ntfs, this will give you the location and letter for your hard drive. when I originally tried, I said no to
chkdsk and mount ntfs.

I also could'nt type in the file name like listed above in step 6ii (type (without
quotes ' cd system~1\_restor~1\rp95\snapshot ')

I actually had to type each part separately, example: cd system~1 enter,
this get's you into the system volume information,

then type _restor~1 enter, this brings up the system restore dir,

type rp to get restore points, pick what restore point you want,

type rp and the # enter, Example: rp150 enter

type dir/p to get a list of files on the directory of the restore point you
selected,

then follow the steps above from step 8.

This worked like a charm. For all of you who aren't familair with it, it's unbelievable, this cd fixes everything, this is a must have for any computer tech, for more info go to:www.hiren.info
Beware there is no step by step guide to using this Boot CD, so you will have to be computer savvy to run the programs.

Thanks Agent Foxx