Technically, you might try the KB828028 patch run in safe mode if you can get it as an archive on another box and then get it on the hurt box's HD via CD read or over a direct box-to-box connection. Unfortunately, easiest way to get rid of error and get to normal boot will probbaly break your networking, so the repair install (AKA quick install, which is a recovery via CD installation that will fix some things including some networking which is involved in this) from a full retail CD of XP might be best. If you can repeat the rollback and get on the web long enough to apply the fix, you can get rid of part of your problem that way also.

ADDED AND MODIFIED after more looking: If not, have hubby help fix if this is at all possible-- the fix is to edit the registry in safe mode, and that gets complex. He needs to remove registered links using lsass.exe to download things. These are entries that are in the registry to fix so you can patch if the direct patch load does not pull them for you. I could give you examples, but there are many possible ways to get what you have, he needs to look at the registry for web calls that invoke lsass.ex with a substring that includes '+lsass.exe' and pull only the web call registry entries. This one is not your fault, someone exploited a hole.

Basicly, once it is back up, the preventive fix is explained in Microsoft Security Bulletin MS04-007. There is a hole in ASN 1.0, which comes with XP. One of the things this hole lets remote folks do is feed things that overflow lsass.exe (and get them entered into the registry to load at startup) and that is part of what might be happening here. You can also look up KB828028 at Microsoft.com and there will be a download link for a new version of ASN that will patch this (should end up with ASN 3.0 after installing download on XP), and there are also other things that patch fixes. That patch will help keep this from happening again once it is fixed this time.

Microsoft is grading this one a critical patch. I recommend everyone with 2000 or XP read KB828028 if it is not on WindowsUpdate openly yet (new installs like mine day before yesterday of XP SP1a DID get it on first update run).

For those of you who are interested, look at http://cve.mitre.org/ , then click the index, choose to search the cve stuff (it is (might still be when you look, might be accepted in the meantime) a CVE candidate), and the search of the cve list will pull it up, and use keyword lsass.exe . Follow the links (via cut-n-paste into a browser tab or window address bar), they show major discussions that make sense--above and beyond what Microsoft explains.

John D.