Tom's Guide | Tom's Hardware | Tom's Games | PC Safety Suite
![]() |
![]() |
![]() |
Comment:
After leaving my PC to download overnight, i rebooted in the morning only to get and error similar to:
"lsass.exe system error - invalid parameters passed to function or service"
I thought WTF? and after a few reboots i knew it was screwed. My guess is that someone has hacked me (for what reason i will never know) or i had been infected with some kind of p00fter virus.
Now this got me angry. But most of all i wanted to use my PC again, without having to fdisk, format etc.
So i traced the problem back to a few of XP's startup files which are loacted in windows\system32\config. Now these files contain information about your software, user accounts, and many other things. This is why you are unable to alter or modify them from within windows itself.
BUT this is where you have to be tricky. You could either get your hands on another Hard Disk with XP, or use something like ntfsdos. Basically you will need something that can read your Hard Disk.
Anyway after fooling around for a bit i came across a folder that i had never really taken much notice of. Its:
c:\System Volume Information
This is a hidden and protected folder that amazingly enough keeps what are know as system restore points for you. Basically it takes note of nearly everything you do.
In this folder there will be some wierd looking folders like:
_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}
if you browse through these you will find other files named something like RP01 or RP35, etc...
Bascially find the one with the highest number and in it will be another folder named snapshot, and in this folder are the files which you need to recover your system:
_registry_user_.default
_registry_machine_security
_registry_machine_software
_registry_machine_system
_registry_machine_samcopy these files to a temp directory and rename them to:
default
security
software
system
samnow you will need to delete the offending files in c:\windows\system32\config and replace them with the new files.
If you get the same error go back and choose another folder (the RP01 etc) to restore from.
After doing so you will be able to boot up and use your PC again.
+1 | ![]() |
Curious! Why did you reboot after a download?
I don't have any of those "Startup" files.
What did you use to view the ("Access is denied") System Volume Information folder?
![]() |
I need help
|
SMart Riser 56 XP drivers
|

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.