Isass.exe application error at log on in windows xp

[Nan]

i've been having this problem for a few days now. every time i turn on the
pc, i get an error message saying: isass.exe application error
application failed to initialize properly (0Xc0000142) click ok to terminate
the application. and the pc shuts down or restart on its own. it does that a
few times or get to a blue screen with the message:
Stop C000021a {Fatal System Error} The Windows Logon Process System
Process terminated unexpectedly with a status of 0X00000402 (0X00000000
0X00000000) The system has been shut down.
my computer is a sony vaio, and i've tried everything from installing
updates to reinstalling windows. i'm stuck now. please help

 

[David H. Lipman]

From: "Nan" <[email protected]>

| i've been having this problem for a few days now. every time i turn on the
| pc, i get an error message saying: isass.exe application error
| application failed to initialize properly (0Xc0000142) click ok to terminate
| the application. and the pc shuts down or restart on its own. it does that a
| few times or get to a blue screen with the message:
| Stop C000021a {Fatal System Error} The Windows Logon Process System
| Process terminated unexpectedly with a status of 0X00000402 (0X00000000
| 0X00000000) The system has been shut down.
| my computer is a sony vaio, and i've tried everything from installing
| updates to reinstalling windows. i'm stuck now. please help
|

I believe you mean; LSASS.EXE not ISASS.EXE . Correct ?

 

[Andrew E.]

Actually Isass.exe is correct..How did you reinstall updates if you cant get
to login screen...If you can get to desktop,locate the Isass.exe file on xp
cd,
L.click,copy to,copy to windows folder on C: drive..Also,thiers simply no way
youve reinstalled windows even 1 time,Isass.exe would have been replaced.
Try booting to xp cd,format & reinstall

 

[Nan]

after a few restart, i actually get to windows, where i get new hardware
found ACPI uniprocessor pc, and rebooth in order for the system change to
take effect.
the computer come with a system recovery and not with the cd, and i can
complete a complete system recovery or a C: drive recovery.
I performed the complete system recovery and that's when i installed all the
updates. but i still had the problem.
i don't know if a C: drive recovery will do the tric

 

[John John]

Don't listen to Andrew E.! He is misleading you here! Isass is not
correct, please answer the question asked by David Lipman. If your
message does indeed refer to isass then you almost certainly are dealing
with a virus. Also, if it is indeed isass that you are dealing with,
David is one of the better qualified person in these groups to help you
with virus removal.

John

 

[John John]

Isass is correct, my ass! The correct file is LSASS which stands for
Local Security Authority Subsystem Service. You can almost bet your
bottom dollar that any close variation on that file name is an almost
dead give away that the file is a virus or malware of some sort!

John

 

[Nan]

It is Isass.exe, not Lsass.exe. i tried doing a C: drive recovery and
installed everything back. it was working normall till after i installed the
following updates: windows xp MSComPackV1 and windows XP KB926239.
i restarted to finish installing those and then i got a blue screen with a
stop message saying fatal error something 0Xc000402, lots more 0s, the system
shut down. it did that a couple of times and when i finally got to windows, i
got the following message: RTHDCPL.exe illegal system DLL relocation
The system DLL user32.dll was relocated in memory. the application will not
run properly. the relocation occured because the DLL
C:\windows\system32\HHCTRL.ocx occupied an address range reserved for windows
system DLL. the vendor applying the DLL should be contacted for a new DLL
i performed a system restore and it seems to be working fine up till now,
except now i get messages saying some services shut down.
now if it is those 2 microsoft updates that are responsible, will that
always happens, because suposely, those are automatics????

 

[John John]

You have a virus/trojan or spyware or pest of some sort. Your computer
is compromised, your problems are not caused by Microsoft updates, they
are caused by pests interfering with valid Microsoft or Windows processes.

Run up to date AV/Antispyware scans on your machine and if that doesn't
help go back in the thread and answer David's questions and ask him to
help you getting rid of the pest.

Information on Isass.exe can be found all over the internet, typically:
http://www.2-spyware.com/file-isass-exe.html
http://searchg.symantec.com/search?...TF-8&ie=UTF-8&proxystylesheet=symc_en_US&x=20

John

 

[David H. Lipman]

From: "John John" <[email protected]>

| Isass is correct, my ass! The correct file is LSASS which stands for
| Local Security Authority Subsystem Service. You can almost bet your
| bottom dollar that any close variation on that file name is an almost
| dead give away that the file is a virus or malware of some sort!
|
| John
|

Thank you john. You have summed this up *very* well.

I'll add another, McAfee, URL point to such malware as the Bropia worm.

http://search.mcafee.com/search?cli..._site.AllTopics&as_dt=i&as_sitesearch=&as_lq=

Malware authors deliberately obfuscate their malicious activity by using the names of
legitimate file (but located in alternate locations) or by slight variations in their name.
In this case the confusion comes from LSASS.EXE and ISASS.EXE and the fact that the lower
case "L" looks similar to the uppercase letter "I:".

The *most* common used name is SVCHOST.EXE.
Example:
%windir%\svchost.exe - is NOT legitimate and is malware.
%windir%\system32\svchost.exe - is the legitimate Win32 file

Then there are the name variations such as; SCVHOST.EXE which is malware.

 

[Nan]

Well i tried some of the stuff and when i tried to rebooth in safe mode, i
couldn't get past the windows logo. i did a C: recovery using the F10 key in
the vaio and i worked fine and supposedly it's in its system factory state. i
installed the antivirus, performed a restart to finish the installation . the
first time i get a blue screen with a stop message. the second time, it kept
reboothing by itself!!!
when i press the F8 key i get nothing and the people on the sony website
couldn't say anything.
the model is VGNFS920 btw
what do i do now???????

 

[John John]

Redo the installation from scratch again and don't reinstall that
AntiVirus software! Try AV software from a different company, the one
you are trying to install seems to have a problem with your pc.

John

 

[David H. Lipman]

From: "John John" <[email protected]>

| Redo the installation from scratch again and don't reinstall that
| AntiVirus software! Try AV software from a different company, the one
| you are trying to install seems to have a problem with your pc.
|
| John
|

This is FREE and is one of the best!

AntiVir -- http://www.freeav.com/

Note: You should be installing WinXP SP2 from scratch and behind a NAT Router such that
while you update the PC you mitigate the chance of Internet worms. Then install AntiVir.

 

[Nan]

Well i've tried everything basically and i finally sent it to a repair shop.
they've changed the hard drive, added more memory. for a moment i thought i
was good, but nada.
i stopped getting isass.exe error or any of those kind, but now it just
freeze after the vaio screen or the windows xp logon sreen and that's it.
and they're telling me there checking or whatever, but it has been there a
week and still nada!!!
what could be causing this????

 

[David H. Lipman]

From: "Nan" <[email protected]>

| Well i've tried everything basically and i finally sent it to a repair shop.
| they've changed the hard drive, added more memory. for a moment i thought i
| was good, but nada.
| i stopped getting isass.exe error or any of those kind, but now it just
| freeze after the vaio screen or the windows xp logon sreen and that's it.
| and they're telling me there checking or whatever, but it has been there a
| week and still nada!!!
| what could be causing this????
|

I have no idea. The symptoms are vague.

For me, the ONLY repair shop would be Sony at this point.

 

[ming.photographer]

From: "Nan" <[email protected]>

| Well i've tried everything basically and i finally sent it to a repair shop.
| they've changed the hard drive, added more memory. for a moment i thought i
| was good, but nada.
| i stopped getting isass.exe error or any of those kind, but now it just
| freeze after the vaio screen or the windows xp logon sreen and that's it..
| and they're telling me there checking or whatever, but it has been therea
| week and still nada!!!
| what could be causing this????
|

I have no idea.  The symptoms are vague.

For me, the ONLY repair shop would be Sony at this point.

I've got problems with Isass.exe. It's a nasty virus that won't budge.
It all started with my AV (Sophos) found a file called DDCCB.DLL.

I've tried deleting it manually, CMD, in Safe Mode, everything. I even
used Processor Explorer from Microsoft to find out what was running it
and it turns out to be Isass.exe. When you try and kill it, it shuts
down the whole machine.

Sophos managed to quarantine the ddccb.dll file but isass.exe is still
running. I've submitted a copy to them and just waiting to hear back
from them.

I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
got time to spend hours downloading AV, running scans, reading
reports. If anyone knows a simpler way of being able to remove this
pest, please, please let us know!!!

 

[Elmo]

I've got problems with Isass.exe. It's a nasty virus that won't budge.
It all started with my AV (Sophos) found a file called DDCCB.DLL.

I've tried deleting it manually, CMD, in Safe Mode, everything. I even
used Processor Explorer from Microsoft to find out what was running it
and it turns out to be Isass.exe. When you try and kill it, it shuts
down the whole machine.

Sophos managed to quarantine the ddccb.dll file but isass.exe is still
running. I've submitted a copy to them and just waiting to hear back
from them.

I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
got time to spend hours downloading AV, running scans, reading
reports. If anyone knows a simpler way of being able to remove this
pest, please, please let us know!!!

Try one of these Virus Removal Tools:

Avast! One tool for any current virus
http://www.avast.com/eng/avast-virus-cleaner.html

Symantec Virus Removal Tools
http://www.symantec.com/business/security_response/removaltools.jsp

F-Secure Virus Removal Tools
http://www.f-secure.com/download-purchase/tools.shtml

Kaspersky Virus Removal Tools
http://www.kaspersky.com/removaltools

 

[David H. Lipman]

From: <[email protected]>


|
| I've got problems with Isass.exe. It's a nasty virus that won't budge.
| It all started with my AV (Sophos) found a file called DDCCB.DLL.
|
| I've tried deleting it manually, CMD, in Safe Mode, everything. I even
| used Processor Explorer from Microsoft to find out what was running it
| and it turns out to be Isass.exe. When you try and kill it, it shuts
| down the whole machine.
|
| Sophos managed to quarantine the ddccb.dll file but isass.exe is still
| running. I've submitted a copy to them and just waiting to hear back
| from them.
|
| I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
| got time to spend hours downloading AV, running scans, reading
| reports. If anyone knows a simpler way of being able to remove this
| pest, please, please let us know!!!

As was stated before is this ISASS.EXE or LSASS.EXE ?

DDCCB.DLL sounds like a Vundo Trojan. Is it C:\windows\system32\ddccb.dll ?



3 phase answer...

Perform Part 1, Part 2 and Part 3

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 6.0,
then you are strongly urged to remove any/all versions.
There are numerous vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 6.0 update 4 (jre 6u4)

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.6.0_04

http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1



Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe


Part 2
------------
Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.

Part 3

 

[Frank]

From: "Nan" <[email protected]>

| Well i've tried everything basically and i finally sent it to a repair shop.
| they've changed the hard drive, added more memory. for a moment i thought i
| was good, but nada.
| i stopped getting isass.exe error or any of those kind, but now it just
| freeze after the vaio screen or the windows xp logon sreen and that's it.
| and they're telling me there checking or whatever, but it has been there a
| week and still nada!!!
| what could be causing this????
|

I have no idea. The symptoms are vague.

For me, the ONLY repair shop would be Sony at this point.

I've got problems with Isass.exe. It's a nasty virus that won't budge.
It all started with my AV (Sophos) found a file called DDCCB.DLL.

I've tried deleting it manually, CMD, in Safe Mode, everything. I even
used Processor Explorer from Microsoft to find out what was running it
and it turns out to be Isass.exe. When you try and kill it, it shuts
down the whole machine.

Sophos managed to quarantine the ddccb.dll file but isass.exe is still
running. I've submitted a copy to them and just waiting to hear back
from them.

I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
got time to spend hours downloading AV, running scans, reading
reports. If anyone knows a simpler way of being able to remove this
pest, please, please let us know!!!

Read
http://www.softwarepatch.com/tips/isass.html

 

[David H. Lipman]

From: "Frank" <[email protected]>


| I've got problems with Isass.exe. It's a nasty virus that won't budge.
| It all started with my AV (Sophos) found a file called DDCCB.DLL.
|
| I've tried deleting it manually, CMD, in Safe Mode, everything. I even
| used Processor Explorer from Microsoft to find out what was running it
| and it turns out to be Isass.exe. When you try and kill it, it shuts
| down the whole machine.
|
| Sophos managed to quarantine the ddccb.dll file but isass.exe is still
| running. I've submitted a copy to them and just waiting to hear back
| from them.
|
| I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
| got time to spend hours downloading AV, running scans, reading
| reports. If anyone knows a simpler way of being able to remove this
| pest, please, please let us know!!!
|
| Read
| http://www.softwarepatch.com/tips/isass.html


Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13

 

[ming.photographer]

From: "Frank" <[email protected]>

| I've got problems with Isass.exe. It's a nasty virus that won't budge.
| It all started with my AV (Sophos) found a file called DDCCB.DLL.
|
| I've tried deleting it manually, CMD, in Safe Mode, everything. I even
| used Processor Explorer from Microsoft to find out what was running it
| and it turns out to be Isass.exe. When you try and kill it, it shuts
| down the whole machine.
|
| Sophos managed to quarantine the ddccb.dll file but isass.exe is still
| running. I've submitted a copy to them and just waiting to hear back
| from them.
|
| I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
| got time to spend hours downloading AV, running scans, reading
| reports. If anyone knows a simpler way of being able to remove this
| pest, please, please let us know!!!
|
| Read
|http://www.softwarepatch.com/tips/isass.html

Download and execute HiJack This! (HJT)http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:http://www.bleepingcomputer.com/forums/forum22.htmlhttp://castlecops.com/forum67.html

Suggested tertiary:http://www.dslreports.com/forum/cle...ums.security-central.us/forumdisplay.php?f=13

Hey Dave,

Thanks for the suggestions. The program which is running is isass.exe.
And yes the ddccb.dll is in that folder.

I'm going to try your suggestion today.

Fingers crossed!