PLEASE HELP!: Isass.exe, a worm, and a standstill problem

[Guest]

About a month ago, I got a virus on my Windows XP named "W32.Beagle-Z"
through e-mail, and a subsequent worm (Sasser?) from the backdoor it opened.
Whenever I tried to login (even from safe mode), I got a message titled
"Isass.exe (or was it lsass.exe?) - System Error" and it said something along
the lines of, "When trying to update a password, this retun status indicates
that th value provided as the current password is not correct.", or something
like that. I can't remember exactly, because about a second later, the
computer shut down and restarted. I never even saw the login screen. Just
that one message that appeared.

It was frustrating, too. Apparently anytime you get within a close proximity
of these things, apparently they were programmed to freeze the computer. Any
virus scanner scanning the area would cause the computer to freeze, even boot
scans.

By using safe mode in Windows Vista (definitely more secure), and an
assortment of antivirus programs, I was able to wipe out the two buggers (I
even ran several subsequent checks, and have found no trace of them. I then
booted up from XP again, but I still got the Isass.exe message. I don't know
what to do now. Should I go in through safe mode in Vista and delete it?
Should I reinstall XP? I don't know. I just want to do anything to get rid of
the problem, save that of erasing all my data. What do I do?

- RoboRed

 

[Ottmar Freudenberger]

About a month ago, I got a virus on my Windows XP named "W32.Beagle-Z"
through e-mail, and a subsequent worm (Sasser?) from the backdoor it opened.

http://www.microsoft.com/technet/security/secnews/articles/gothacked.mspx

| The only way to clean a compromised system is to flatten and rebuild

And I wholeheartly agree with the statements on that site.

Bye,
Freudi

 

[Newbie Coder]

RoboRed

The backdoor you wrote about is TCP/IP Port 1234

Info on that mass mailing virus:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-070515-0600-99&tabid=1

Removal tool:

Page:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-011916-0524-99

Tool:

http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FxBeagle.exe

-----------------------------------------------------

Sasser Info:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050116-1831-99

Removal Tool:

Page:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050114-1706-99

Tool:

http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FxSasser.exe

If you say it ISASS.exe then here's how to remove it:

http://www.symantec.com/security_response/writeup.jsp?docid=2005-021115-5938-99&tabid=3

Another trojan using the same name:

http://www.symantec.com/security_response/writeup.jsp?docid=2005-030223-4952-99&tabid=3

 

[Poprivet]

About a month ago, I got a virus on my Windows XP named "W32.Beagle-Z"
through e-mail, and a subsequent worm (Sasser?) from the backdoor it
opened. Whenever I tried to login (even from safe mode), I got a
message titled "Isass.exe (or was it lsass.exe?) - System Error" and
it said something along the lines of, "When trying to update a
password, this retun status indicates that th value provided as the
current password is not correct.", or something like that. I can't
remember exactly, because about a second later, the computer shut
down and restarted. I never even saw the login screen. Just that one
message that appeared.

It was frustrating, too. Apparently anytime you get within a close
proximity of these things, apparently they were programmed to freeze
the computer. Any virus scanner scanning the area would cause the
computer to freeze, even boot scans.

By using safe mode in Windows Vista (definitely more secure), and an
assortment of antivirus programs, I was able to wipe out the two
buggers (I even ran several subsequent checks, and have found no
trace of them. I then booted up from XP again, but I still got the
Isass.exe message. I don't know what to do now. Should I go in
through safe mode in Vista and delete it? Should I reinstall XP? I
don't know. I just want to do anything to get rid of the problem,
save that of erasing all my data. What do I do?

- RoboRed

You can search for that, and find complete removal instructions at
www.symantec.com . That's a nasty virus.

HTH
Pop`