Maximum PC

I was given an eMachines T3418 desktop computer the other night by a co-worker. The issue with this computer was a dialogue box (that referred to an lsass.exe file) that appeared at the Windows XP Home Edition welcome screen both in normal mode and in Safe mode. When I clicked the "OK" button in the dialogue box, the system rebooted and repeated the behavior. A little bit of research told me that the lsass.exe file is a legitimate Windows file that has something to do with the User Accounts in Windows XP, but little else. I have tried using a Knoppix Live CD to boot the computer, but was unable to find any personal data files to back up in the File Manager applet, so I tried using a rescue disk to scan for and remove any possible malware that might have caused this issue, but no joy. I even attempted a repair installation of Windows XP Home Edition with Service Pack 3 with a slipstreamed disk, but the same dialogue box came up when the system rebooted in order to attempt the repair installation.

I have researched the support section for this machine at the eMachine's site, but am unable to find any useful information for accessing the hidden restore partition on the Seagate 250 GB SATA hard drive (yes, it is there), in order to perform a factory restore on this system. The support site recommends pressing the "ALT" and "F10" keys repeatedly at the eMachines logo screen during boot up, but this does not work. I have worked on at least one other eMachines computer (which had Windows XP Media Center Edition as its OS) where the factory restore from its hidden partition was facilitated by pressing the "F11" key during the boot process, and it was successful for that particular machine, but does not appear to work for this machine. Does anyone have any suggestions as to which keys need to be pressed during the boot process in order to perform a factory restore from the hidden partition on the hard drive on this system? Thanks in advance for any and all helpful replies to this post.

Note: This machine has a Phoenix-Award BIOS that has no option to disable the eMachines logo screen and that logo screen only tells me to use the "F2" button to access the BIOS and "F10" to display the Boot Menu for this machine. Given the fact that this machine uses an old AMD Sempron processor and has a motherboard with a maximum memory capacity of two 1 GB memory modules, I am guessing that this machine was manufactured around 2005 or 2006.

there should be an executable that will copy the restore partition to disk, if a set of disks was already made, I dont think it will do a restore from the partition.

there used to be a virus years ago with the same name, lsass and it was a bitch to get rid of, there used to be something on line that would remove it, I dont know if it is still around.

http://www.file.net/process/lsass.exe.html

Thanks for the reply, g.m.waters. The link you posted was one that I looked at in my research and I do believe that the Sasser worm was what infected this computer to the point that it just rebooted the system continually and I could never get into Windows at all. The owner of the computer has not made any recovery disks whatsoever, and the executable file you allude to cannot be found as I cannot get into the Windows OS in the first place.

Emachines from that era usually came with Restore CD's. Maybe prev owner has it somewhere in a box or drawer.

Thanks, FrostyWinnipeg. I am already having the current owner explore that option as the previous owner was her brother.