Member Avatar for Jwborc39963

hi. I'm Jason. I'm new here and I am asking for help everywhere so if you have an answer to my problem then please e-mail me as I will probably forget to check back here.

ok so my dad wanted to change the administrator password on his computer. he didn't know that XP had a built in control panel applet to do that so his IT guy at work gave him some unix code to change it. the only problem is that XP has 128 bit encryption and NT doesn't. also NT is based on a 16-bit design and XP is 32. so when he applied the new password, the computer crashed. we can't get it to boot anymore. we did a non-destructive system-restore from HP and now windows says that it recieved an illegal instruction from lsass.exe. I have taken teh hard drive out and put it into my computer and I used a program called cain and abel to try to crack the administrator password because we can't log into the recorevy console on an XP startup disk. it's weird because teh administrator account doesn't have any hashes to crack, but when you just hit enter in teh recovery console, nothing happens! it says that was the wrong password. PLEASE E-MAIL BACK!!!!!! . this is my family's business computer and if we don't get this fixed, we could lose a lot! we need ot keep the ifles and programs on the computer because they are business related. PLEASE E-MAIL ME BACK!!!!

thanks,
Jason

  • 4 Contributors
  • 4 Replies
  • 130 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by antioed

Dani AI

Generated

Immediate priorities for : stop writing to that drive and make a full forensic copy (sector image) before any more experiments. Re-running password crackers or boot utilities that modify the disk risks further corruption of the registry hives and the SAM, and will reduce the chance of a clean recovery.

Safely get the business files off first. Attach the drive to a working machine (USB/SATA adapter or as a slave) or boot a separate machine with a Windows PE / BartPE environment or a Linux live system that mounts the NTFS volume read-only. Use a sector-imaging tool (for example, a dd-style image or a forensic imager) to create an image, then copy needed files from the image. If file permissions block access, employ a recovery environment that runs as SYSTEM so files can be copied without changing the original disk.

After data is secure, try repairing system files rather than repeating risky edits. A Windows XP in-place (repair) install from a genuine XP CD will reinstall core system binaries (including lsass-related components) while keeping applications and profiles intact; after repair, apply service packs and security updates. If the repair fails or the SAM is badly corrupted, restore the image to a replacement disk and perform a clean install, then restore user data from the backup.

Notes tied to the thread: correctly prioritized copying files. ’s observation that lsass crashes indicate damaged or mismatched system files is consistent with these recovery steps. ’s question about UNIX was valid — other OS environments can only change Windows if they mount and write to the Windows disk; that is why imaging and read-only access matter. If unsure at any step, seek professional data-recovery help rather than continuing risky tools.

Recommended Answers

All 4 Replies

Member Avatar for YoungCoder

hi. I'm Jason. I'm new here and I am asking for help everywhere so if you have an answer to my problem then please e-mail me as I will probably forget to check back here.

ok so my dad wanted to change the administrator password on his computer. he didn't know that XP had a built in control panel applet to do that so his IT guy at work gave him some unix code to change it. the only problem is that XP has 128 bit encryption and NT doesn't. also NT is based on a 16-bit design and XP is 32. so when he applied the new password, the computer crashed. we can't get it to boot anymore. we did a non-destructive system-restore from HP and now windows says that it recieved an illegal instruction from lsass.exe. I have taken teh hard drive out and put it into my computer and I used a program called cain and abel to try to crack the administrator password because we can't log into the recorevy console on an XP startup disk. it's weird because teh administrator account doesn't have any hashes to crack, but when you just hit enter in teh recovery console, nothing happens! it says that was the wrong password. PLEASE E-MAIL BACK!!!!!! . this is my family's business computer and if we don't get this fixed, we could lose a lot! we need ot keep the ifles and programs on the computer because they are business related. PLEASE E-MAIL ME BACK!!!!

thanks,
Jason

erm....how the hell can unix code affect windows xp, they are completely diffrent operating systems.... :rolleyes:

Member Avatar for Jwborc39963

erm....how the hell can unix code affect windows xp, they are completely diffrent operating systems.... :rolleyes:

uhhhh, a boot disk! you can boot from linux you know...

Member Avatar for qt 3.14159

If you've put the hard drive into your computer, does it not let you copy your files so you can backup the files you need and then reinstall everything from scratch?

Member Avatar for antioed

If The lsass.exe (Local Security Authority) process is blowing up after a system restore to a point where the SAM was before it was blown up with the bootdisk then the problems with lsass must be unrelated to whatever happened when the bootdisk was run, which is usually the SAM since that's where you're writing the new hashes to. There is a vulnerability in the lsass.exe process; my thought is that when you restored the system it was restored back to a point where this patch had not been installed yet. Just a theory...so test it out. Disconnect your internet connection and go into the Control Panel then Add/Remove Programs and see if "Windows XP Hotfix (KB835732)" is installed. If that's all it is then download the patch from MS on a floppy and go over and install it on the problem machine:

You probably blew up the SAM (Security Accounts Manager) when you mounted it with the Linux boot disk, it's the chance you take with those bootdisks. At one point I was appointed "Almighty Hackerish Puba" at my company because I was the only one in the IT department who didn't cringe at the mention of anything related to Linux or any other non-MS operating system...I had been messing around with the Offline NT password bootdisk and we had all these machines that nobody knew the Admin pw for so I was given "carte blanche" go around hacking up machines all day long with that bootdisk...it was pretty common to blow up the OS in some fashion when using that utility, I don't think XP is exempt to the bootdisk's capabilities or it's imperfections - you simply run a risk when you mess around with the SAM.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.