A message pops up on booting windows and starts counting down to shutdown, the symtoms of a virus, giving the reason as a problem with lsass.exe. I tried to re-install windows with no effect. I installed a 10 gig HD and installed Win XP pro and Norton AV and updated both. I used this HD to scan the HD (80 gig) now running as slave with the lsass.exe problem with the updated Norton AV, no virus found. I then copied the downloaded patch from MS from the clean 10 gig HD to the problematic 80 gig, then booted off of the 80 gig HD. I stop the countdown with the shutdown -a command, and installed the patch, still no effect. I copied the lsass.exe file from the clean 10 gig to the 80 gig in the proper place, still no effect. I have run MS security tool, and Stinger, and anti-spy software, still no effect. I can't think of anything else to do, any suggestions?
When I boot and stop the countdown, I have no admin rights, so I can't change any accounts settings, or even see the admim window, it is blank when it shows up. What next??? I have 3 years worth of data that I don't want to lose, else I would reformat and start over.

Usually whet you describe is caused by the Sasser Worm. Have you used the removal tool from Symantec, Panda, or Trend Micro. If you were installing XP and were connected to the internet you could have picked it up during the installation process. Make sure you have system restore turned off, or you will reinfect the system after each restart. You have to turn system restore off and restart the computer, then you can use the removal tool. After the system is fixed, you can turn system restore back on, if you like using it. You get to system restore by selecting properties when opening My Computer, select turn it off. HTH

To be really safe, slave the hard drive to another comp, clean it up & copy your stuff onto that comp. When you get it clean, get SP2.
Download sp2 from one of these. Once installed get all the critical updates, choose Custom install.
http://www.softwarepatch.com/windows/xpsp2.html

http://downloads.guru3d.com/download.php?det=846

Slave it to another HD/comp ( no need to bolt it in, just cable it & leave it outside the case ) & copy your stuff onto the other HD.
You may have a choice of jumper settings on the master HD, such as master with slave or ms.

Also, you may like to do this when all is OK.

There are four services associated with lsass.exe and most users (especially home users) do not need any of them running.

They are:
IPSEC services
Net Logon
NT LM Security Support Provider
Protected Storage

Type "services.msc" in run, press Enter and disable them.
http://majorgeeks.com/page.php?id=12
http://www.blackviper.com/WinXP/servicecfg.htm

capt,
I was not connected to the internet while installing XP on either hard drive, I am presently connected and running XP with no other software other than Norton AV, and now AVG antivirus running on it. All of my programs and data are on the other HD. When I try to boot off of the 80 gig HD it gets stuck on the welcome screen, with no accounts listed, when I shutdown, it briefly shows the accounts for a split second, and it will not boot into safe mode, it gets stuck in the DOS window while loading the files.
Even before, when it would boot up, I couldn't get into to the screen to turn off restore. I have run the Stinger tool, that removes Sasser and variants, to no effect, it does not find any worms or virus. Is there a way to migrate files to another HD to include the programs, the data can be backed up and a virus scan run on them? I have lost the disks on some of the software so I hate to lose the programs that are associated with my three years worth of data.

Johnw,
Thanks, I have effectively slaved the messed up HD to another computer by installing a smaller HD and booting off of it, and I am trying to clean it up, but so far no luck, any ideas? I switch between the two HD is BIOS to boot off of either, but now the 80 gig will not give a clean boot, it always hangs. No virus detected on either HD with Norton or AVG, and Stinger does not detect the lsass virus.

gcolbert, I'm lost, sorry unable to follow your info.

You can click on my name & send screenshots or other, via email if you want to.