Hi there,

Customer has Server 2003 SP2, 32bit and is experiencing startup issues after
a reboot.

The lsass.exe gives an error and event ids 1000 and 1015 are logged.
We are not able to logon to the server in normal mode nor in safe mode but
are able to logon using safe mode with networking.

When we logon, we have no internet access and cannot perform administrative
work as that also gives an error (ex trying to create a local admin account)

What urgent steps could we take?



thanks,

Dan

Exact syntax of the errors might be helpful. For the lsass.exe, you should
spell it out. For errors in the event logs, the Event ID and Source, plus
a bit of the syntax if it includes error codes.

Or, you can go to www.eventid.net and check them.

However, this sounds a lot like the cornflicker virus (i think that is the
name), the one called variously Anti Virus 200x or Internet Security 200x
and so on. Any popups?

-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com

> Hi there,
>
> Customer has Server 2003 SP2, 32bit and is experiencing startup issues
> after a reboot.
>
> The lsass.exe gives an error and event ids 1000 and 1015 are logged.
> We are not able to logon to the server in normal mode nor in safe mode
> but
> are able to logon using safe mode with networking.
> When we logon, we have no internet access and cannot perform
> administrative work as that also gives an error (ex trying to create a
> local admin account)
>
> What urgent steps could we take?
>
> thanks,
>
> Dan
>

No popups Larry
Everything else is fine on the network... doesn't seem to be the case of
malware...

I am thinking about rebuilding the OS, Exchange and then restore exchange
from the files sinde the customer has no full online backup of exchange...
just the database and log files are intact...

Have never done an exchange restoration... any articles, tips are welcomed!

Dan

"Larry Struckmeyer[SBS-MVP]" <lstruckmeyer@newsgroup-wizards.com> wrote in message
news:4e683515f0cf8ccb4bb44d1f5cd@newsgroup

> Exact syntax of the errors might be helpful. For the lsass.exe, you
> should spell it out. For errors in the event logs, the Event ID and
> Source, plus a bit of the syntax if it includes error codes.
>
> Or, you can go to www.eventid.net and check them.
>
> However, this sounds a lot like the cornflicker virus (i think that is the
> name), the one called variously Anti Virus 200x or Internet Security 200x
> and so on. Any popups?
> -
> Larry
> Please post the resolution to your
> issue so others may benefit
> -
> Get Your SBS Health Check at
> www.sbsbpa.com
>
>

>> Hi there,
>>
>> Customer has Server 2003 SP2, 32bit and is experiencing startup issues
>> after a reboot.
>>
>> The lsass.exe gives an error and event ids 1000 and 1015 are logged.
>> We are not able to logon to the server in normal mode nor in safe mode
>> but
>> are able to logon using safe mode with networking.
>> When we logon, we have no internet access and cannot perform
>> administrative work as that also gives an error (ex trying to create a
>> local admin account)
>>
>> What urgent steps could we take?
>>
>> thanks,
>>
>> Dan
>>

>
>