How to replace lsasrv.dll 1

[pinkpanther56]

I'm having an issue with this patch

http://support.microsoft.com/kb/958058

I haven't had any luck getting it to work, I install it and it shows in the add/remove window but the lsasrv.dll file hasn't changed and the flaw still exists. I've uninstalled and reapplied but it still fails to work.

I've extracted the file manually but I can't replace the lsasrv.dll as it's in use even in safe mode. I need to apply this to 150 desktops can anyone suggest a wat that I could replace this file and preferably automate the task?

Thanks.

 

[gariel420]

look for a tool called unlocker 1.8.7.exe in google, its free. And get yourself a new .dll from a download site

you can probably delete this file in windows, no safe mode needed, use kill process of unlocker which should come up automatically

 

[pinkpanther56]

I've used unlocker before but the lsasrv.dll file in use by a critical windows process and locked by the system.

This process could be hard to automate as well.

 

[linney]

When you install the recommended Hotfix did you try giving it a clean environment to run in? Perhaps by temporarily disabling all running security programs, or even all other running programs and non-Microsoft Services?

I don't know of anything that can automate the replacement of a single file and do it out of the XP environment. On a single machine I would slip it in via Recovery Console, BartPE, or a dual booted operating system.

I suppose at least if you get it in on a single machine you can test it out on that machine to see if it is going to fix your main problem.

 

[Lemon13]

i use this

http://www3.telus.net/_/replacer/

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[pinkpanther56]

@ linney, I logged on as a local admin and turned off AV but it still didn't work. The strange thing is I can see the file disappear and reappear but it's not replaced with the version in the patch file. I'm wondering if windows is somehow replacing it again. Thanks.


@ Lemon13, I'll take a look at the link thanks.

 

[BadBigBen]

PP -

1. boot into SafeMode as Administrator
2. navigate to "C:\WINDOWS\system32\dllcache" replace the file...
3. then navigate to "C:\WINDOWS\system32" and replace the file...
4. reboot...


addendum: the following version is installed on my system, 5.1.2600.5834, which surpasses the one that is listed in the HotFix...

DOUBLE CHECK the versions!!!

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

You could boot up with a BART PE CD that also has the file on it and then just delete the one in the windows installation and copy the one you want into place.

I use this method when malware has removed something like Winlogon.exe or Userinit.exe

You don't have to have a bootable version of windows.

 

[pinkpanther56]

@ BadBigBen, I've tried your suggestion before but you can't replace lsasrv.dll in safe mode. The dll versions are below but 5827 is what MS emailed me to replace this with. 5835 is the version that was updated and broken by XP SP3 that's when the issue was introduced.

Old file on my XP SP3 box is 5.1.2600.5834
New file from patch 5.1.2600.5827

I'm going to contact MS again to query the patch.

Thanks.

 

[linney]

222193 - Description of the Windows File Protection Feature

http://support.microsoft.com/default.aspx?scid=kb;en-us;222193&FR=1&PA=1&SD=HSCH

 

[Geates]

Slave the harddrive and remove/replace the file. Only 149 left!

-Geates

 

[pinkpanther56]

I'm contacting MS as I've replaced the file using replacer this replaced the file in C:\WINDOWS\system32\dllcache and System32. I verified the version but the flaw still exists. If however I slip the fix into install media and build a system it's fixed. It's all very odd.

 

[pinkpanther56]

I see they had the same issue in this thread, you need to view it through google cache to see the solution. This is pre patch and they replaced it with the SP2 version.

http://www.experts-exchange.com/Networking/Windows_Networking/Q_23696943.html

Any ideas how I might inform MS that I don;t think this patch works?

 

[linney]

How to report a bug to microsoft?

http://www.google.com/search?q=repo...-au&ie=UTF-8&oe=UTF-8&startIndex=&startPage=1

Incident Reports for Technical Support from Microsoft

http://ampalliance.org/blogs/micros...rts-for-Technical-Support-from-Microsoft.aspx

Microsoft Product Support Reports

http://www.microsoft.com/downloads/...7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=en

 

[pinkpanther56]

Just thought that i'd report back with what I found out with MS PSS.

Update KB968389 updates to 5.1.2600.5834 which is why I can't install the update as it tries to rollback to 5.1.2600.5827.

1. Fully patched XP SP3 box inc KB968389 lsasrv.dll now 5.1.2600.5834 / Mandatory profile fails

2. Remove KB968389 lsasrv.dll now 5.1.2600.5755 / Mandatory profile fails

3. Install KB958058 lsasrv.dll now 5.1.2600.5827 / Mandatory profile works

4. Install KB968389 lsasrv.dll now 5.1.2600.5834 / Mandatory profile works now which is odd.

http://support.microsoft.com/kb/958058

This fix is only for roaming profiles and doesn't work if you have a Default User profule in Netlogon on your DC's that copies over at logon.

Even though MS broke this with SP3 (while in mainstream support) they aren't going to fix it as it's fixed in Vista SP1 and XP is now is extended support.

 

[goombawaho]

You are unlucky sir.