Need help

Hi to everyone.
My friend asked me to help her about one problem with her computer.

She has older computer with Matsonic mainboard I think 1700+ Athlon 512 mb RAM. The problem is that after the welcome screen in Windows XP Service Pack 2 one message appears: "Indicates a revision number encountered of or specified is not one known by the service. It may be a more recent revision than the service is aware of" with a red circle with X in the center at the begining of this message.

I have never seen this message before and if someone know what is the best solution for this problem please let me know.

Thank's in advance.

 

Hello,
Could you check in the event viewer for more details?
Mrk

 

Hello Mrkvonic,

No, I can't. I tried to reboot computer in safe mode, and with last known good configuration option and nothing helped.
I know I can reinstall XP and solve the problem but I am asking if there is any other solution for this problem.

 

Hello,
Maybe I misunderstood.
Can you get to the Windows desktop at all?
Mrk

 

No, It doesn't appears at all.
That's the problem, maybe I wasn't 100% clear.

Thanks.

 

I will see if the RAM is problem and post the result.
Thank's Stapp for recommendation.

 

The only thing that I found on the Microsoft site that is related to this message is that all you have to do is click OK to continue which isn't a lot of help.

 

Hello compatriot!

MS mentions this in their bulletin kb155012 from feb 26th as an error 1305L, but no explanation is given. I also saw the same as ccsito, but after clicking "ok" your computer should continue to boot normally. However, that's not your case. Is there any process tied to that error message?

 

Hello,

There isn't any proces tied which I can see, when I click "Ok", the computer restarts. Maybe the best solution is to reinstall complete XP?

 

Hi again

Well I asked about a process as there are some cases where the same happens but with lsass process tied to error. A sasser worm does this As there is no process tied in your case, I'd also suspect RAM. Have you tried changing modules?

That would certainly be the 'quickest' and 'simplest' solution. But not very wise, as that thing could happen again and you learned nothing from this experience...

Cheers.

 

Hello again Sasa.

As promised in PM, I'm back with the link(s) I found. Now, I'm posting this under the assumption that the Sasser worm is the cause of your (friend's) problem. As you said (in PM), it may be possible that the lsass.exe process is involved with the error message. Although these links don't provide a solution, I'll just post them as well, for your insight.

This link provide a solution for cleaning Sasser. Although it's a bit dated (as is the Sasser), the links posted in this discussion are still valid. Please try the dedicated Symantec removal tool from post #4 by "Madeline". You would have to gain access to another bootable machine with a CD writer in order to write the tool on a (bootable) CD and boot the infected PC from it. Microsoft also addresses Sasser here. According to them, if your OS is fully patched, their Malicious Software Removal Tool will keep you safe from this.

As I said before, this is only my assumption that the Sasser is the cause. I have never been infected with it, so I actually don't have a first-hand experience here. My assumptions are based exclusively on googling...

If this doesn't work, try the RAM...
Please report back with the results.

Regards

 

Hi,

I will scan the computer tonight to see if the virus is a troublemaker and post the results. I tried with replacing RAM and it didn't help. Stapp thank's anyway.

Best Regards.

 

Hello again,

I scanned her computer with Mcafee antivirus and it found some spyware (ISTBar...). I deleted all and the problem still exists. I also tried with replacing RAM and it didn't helped.
I think I will reinstall Windows, that would certanly solve the problem.
Knowing her, I still think that she wasn't carefull while she was using computer so it could be a whole bunch of reasons why the computer isn't operationall now.

Thank's to all for trying to help.

Best Regards.