Ok, onmy othr comp, i got sent an instant message, it said something like "I hope you didnt forget this picture we took!" and i opend it because i did take a lot of pictures with this person... I asked while it was downloading if it was a virus and a response said " no it isnt a virus its an old picture" (something to that effect). Anyway, i got a message to shutdown in like 60 seconds... the file that was effected was lsass.exe in my windows/sysem32 folder so i deleted the two files that has lsass in them one dll and one exe. I cant reboot in safemode... I have really important things on there that cannot be lost! SOMEONE PLZ HELP ME!!!!!!!!!!!!

Howdy Yuscu2 and welcome to the forums
We can fix this pretty easy if you have your XP disc..
If you can boot into safe mode with command you can type this in

chkdsk /R notice the space between the k and the switch it is needed to be there.

If not your going to have to do a repair install to keep your files. lsass. exe is a valid file unless it is located outside of your windows 32 folder the it is a virus.

Do you have your XP disk?

ok, i have my xp os disc and my xp driver recovery disc, which one?

Unforchantly no. If you could boot into windows I can have you download the file. Do you have a dell or an HP pc?

Ok put your disc in your drive and follow the directions as follow.


Let windows do its thing while it is loading all the drivers and etc..

You will come to the blue page asking what you would like to do. Click install XP on this partition (the one that already has it on there)
Let it do its thing I think for about a minute then it will ask you if you want to do a repair install or fresh install. Pick repair..it will seem like it is doing a fresh install but all your files and music etc. will be safe.
here is a full version of my instructions dont mind the warnings though there just there to protect him..

http://www.michaelstevenstech.com/XPrepairinstall.htm
The when you come back we can do a hijack this log on ya.

ok its running... so my computer will be running just like it was befor the infection?

yes but it might still have the infection. But you will be able to take care of it then instead of being locked out of it.

so, how would i get rid of it, just delet lsass.exe? idk how to handle it if its so critical?