Isass.exe application error at log on in windows xp

Nan

unread,

Feb 5, 2008, 8:56:03 PM2/5/08

to

i've been having this problem for a few days now. every time i turn on the
pc, i get an error message saying: isass.exe application error
application failed to initialize properly (0Xc0000142) click ok to terminate
the application. and the pc shuts down or restart on its own. it does that a
few times or get to a blue screen with the message:
Stop C000021a {Fatal System Error} The Windows Logon Process System
Process terminated unexpectedly with a status of 0X00000402 (0X00000000
0X00000000) The system has been shut down.
my computer is a sony vaio, and i've tried everything from installing
updates to reinstalling windows. i'm stuck now. please help

David H. Lipman

unread,

Feb 5, 2008, 9:13:42 PM2/5/08

to

From: "Nan" <N...@discussions.microsoft.com>

I believe you mean; LSASS.EXE not ISASS.EXE . Correct ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Andrew E.

unread,

Feb 6, 2008, 12:26:00 AM2/6/08

to

Actually Isass.exe is correct..How did you reinstall updates if you cant get
to login screen...If you can get to desktop,locate the Isass.exe file on xp
cd,
L.click,copy to,copy to windows folder on C: drive..Also,thiers simply no way
youve reinstalled windows even 1 time,Isass.exe would have been replaced.
Try booting to xp cd,format & reinstall

Nan

unread,

Feb 6, 2008, 2:10:00 AM2/6/08

to

after a few restart, i actually get to windows, where i get new hardware
found ACPI uniprocessor pc, and rebooth in order for the system change to
take effect.
the computer come with a system recovery and not with the cd, and i can
complete a complete system recovery or a C: drive recovery.
I performed the complete system recovery and that's when i installed all the
updates. but i still had the problem.
i don't know if a C: drive recovery will do the tric

John John

unread,

Feb 6, 2008, 6:29:48 AM2/6/08

to

Don't listen to Andrew E.! He is misleading you here! Isass is not
correct, please answer the question asked by David Lipman. If your
message does indeed refer to isass then you almost certainly are dealing
with a virus. Also, if it is indeed isass that you are dealing with,
David is one of the better qualified person in these groups to help you
with virus removal.

John

John John

unread,

Feb 6, 2008, 6:35:15 AM2/6/08

to

Isass is correct, my ass! The correct file is LSASS which stands for
Local Security Authority Subsystem Service. You can almost bet your
bottom dollar that any close variation on that file name is an almost
dead give away that the file is a virus or malware of some sort!

John

Nan

unread,

Feb 6, 2008, 8:54:00 AM2/6/08

to

It is Isass.exe, not Lsass.exe. i tried doing a C: drive recovery and
installed everything back. it was working normall till after i installed the
following updates: windows xp MSComPackV1 and windows XP KB926239.
i restarted to finish installing those and then i got a blue screen with a
stop message saying fatal error something 0Xc000402, lots more 0s, the system
shut down. it did that a couple of times and when i finally got to windows, i
got the following message: RTHDCPL.exe illegal system DLL relocation
The system DLL user32.dll was relocated in memory. the application will not
run properly. the relocation occured because the DLL
C:\windows\system32\HHCTRL.ocx occupied an address range reserved for windows
system DLL. the vendor applying the DLL should be contacted for a new DLL
i performed a system restore and it seems to be working fine up till now,
except now i get messages saying some services shut down.
now if it is those 2 microsoft updates that are responsible, will that
always happens, because suposely, those are automatics????

John John

unread,

Feb 6, 2008, 9:47:35 AM2/6/08

to

You have a virus/trojan or spyware or pest of some sort. Your computer
is compromised, your problems are not caused by Microsoft updates, they
are caused by pests interfering with valid Microsoft or Windows processes.

Run up to date AV/Antispyware scans on your machine and if that doesn't
help go back in the thread and answer David's questions and ask him to
help you getting rid of the pest.

Information on Isass.exe can be found all over the internet, typically:
http://www.2-spyware.com/file-isass-exe.html
http://searchg.symantec.com/search?q=OptixPro&site=symc_en_US&entqr=0&hitsceil=100&sort=date%3AD%3AL%3Ad1&output=xml_no_dtd&client=symc_en_US&charset=utf-8&ud=1&context=gbh&y=10&oe=UTF-8&ie=UTF-8&proxystylesheet=symc_en_US&x=20

John

David H. Lipman

unread,

Feb 6, 2008, 5:07:00 PM2/6/08

to

From: "John John" <aude...@nbnet.nb.ca>

| Isass is correct, my ass! The correct file is LSASS which stands for
| Local Security Authority Subsystem Service. You can almost bet your
| bottom dollar that any close variation on that file name is an almost
| dead give away that the file is a virus or malware of some sort!
|
| John
|

Thank you john. You have summed this up *very* well.

I'll add another, McAfee, URL point to such malware as the Bropia worm.

http://search.mcafee.com/search?client=default_frontend&output=xml_no_dtd&proxystylesheet=default_frontend&ie=UTF-8&oe=UTF-8&as_q=isass.exe&as_epq=&as_oq=&as_eq=&as_occt=any&sort=&num=10&btnG=Search&site=us_site.AllTopics&as_dt=i&as_sitesearch=&as_lq=

Malware authors deliberately obfuscate their malicious activity by using the names of
legitimate file (but located in alternate locations) or by slight variations in their name.
In this case the confusion comes from LSASS.EXE and ISASS.EXE and the fact that the lower
case "L" looks similar to the uppercase letter "I:".

The *most* common used name is SVCHOST.EXE.
Example:
%windir%\svchost.exe - is NOT legitimate and is malware.
%windir%\system32\svchost.exe - is the legitimate Win32 file

Then there are the name variations such as; SCVHOST.EXE which is malware.

Nan

unread,

Feb 7, 2008, 9:15:02 PM2/7/08

to

Well i tried some of the stuff and when i tried to rebooth in safe mode, i
couldn't get past the windows logo. i did a C: recovery using the F10 key in
the vaio and i worked fine and supposedly it's in its system factory state. i
installed the antivirus, performed a restart to finish the installation . the
first time i get a blue screen with a stop message. the second time, it kept
reboothing by itself!!!
when i press the F8 key i get nothing and the people on the sony website
couldn't say anything.
the model is VGNFS920 btw
what do i do now???????

John John

unread,

Feb 8, 2008, 5:28:13 PM2/8/08

to

Redo the installation from scratch again and don't reinstall that
AntiVirus software! Try AV software from a different company, the one
you are trying to install seems to have a problem with your pc.

John

David H. Lipman

unread,

Feb 8, 2008, 5:59:19 PM2/8/08

to

From: "John John" <aude...@nbnet.nb.ca>

| Redo the installation from scratch again and don't reinstall that
| AntiVirus software! Try AV software from a different company, the one
| you are trying to install seems to have a problem with your pc.
|
| John
|

This is FREE and is one of the best!

AntiVir -- http://www.freeav.com/

Note: You should be installing WinXP SP2 from scratch and behind a NAT Router such that
while you update the PC you mitigate the chance of Internet worms. Then install AntiVir.

Nan

unread,

Feb 21, 2008, 7:14:02 PM2/21/08

to

Well i've tried everything basically and i finally sent it to a repair shop.
they've changed the hard drive, added more memory. for a moment i thought i
was good, but nada.
i stopped getting isass.exe error or any of those kind, but now it just
freeze after the vaio screen or the windows xp logon sreen and that's it.
and they're telling me there checking or whatever, but it has been there a
week and still nada!!!
what could be causing this????

David H. Lipman

unread,

Feb 21, 2008, 7:25:45 PM2/21/08

to

From: "Nan" <N...@discussions.microsoft.com>

| Well i've tried everything basically and i finally sent it to a repair shop.
| they've changed the hard drive, added more memory. for a moment i thought i
| was good, but nada.
| i stopped getting isass.exe error or any of those kind, but now it just
| freeze after the vaio screen or the windows xp logon sreen and that's it.
| and they're telling me there checking or whatever, but it has been there a
| week and still nada!!!
| what could be causing this????
|

I have no idea. The symptoms are vague.

For me, the ONLY repair shop would be Sony at this point.

ming.pho...@gmail.com

unread,

Mar 5, 2008, 6:56:34 AM3/5/08

to

On 22 Feb, 00:25, "David H. Lipman" <DLipman~nosp...@Verizon.Net>
wrote:

I've got problems with Isass.exe. It's a nasty virus that won't budge.
It all started with my AV (Sophos) found a file called DDCCB.DLL.

I've tried deleting it manually, CMD, in Safe Mode, everything. I even
used Processor Explorer from Microsoft to find out what was running it
and it turns out to be Isass.exe. When you try and kill it, it shuts
down the whole machine.

Sophos managed to quarantine the ddccb.dll file but isass.exe is still
running. I've submitted a copy to them and just waiting to hear back
from them.

I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
got time to spend hours downloading AV, running scans, reading
reports. If anyone knows a simpler way of being able to remove this
pest, please, please let us know!!!

Elmo

unread,

Mar 5, 2008, 7:51:30 AM3/5/08

to

Try one of these Virus Removal Tools:

Avast! One tool for any current virus
http://www.avast.com/eng/avast-virus-cleaner.html

Symantec Virus Removal Tools
http://www.symantec.com/business/security_response/removaltools.jsp

F-Secure Virus Removal Tools
http://www.f-secure.com/download-purchase/tools.shtml

Kaspersky Virus Removal Tools
http://www.kaspersky.com/removaltools

--
Joe =o)

David H. Lipman

unread,

Mar 5, 2008, 4:15:01 PM3/5/08

to

From: <ming.pho...@gmail.com>

|
| I've got problems with Isass.exe. It's a nasty virus that won't budge.
| It all started with my AV (Sophos) found a file called DDCCB.DLL.
|
| I've tried deleting it manually, CMD, in Safe Mode, everything. I even
| used Processor Explorer from Microsoft to find out what was running it
| and it turns out to be Isass.exe. When you try and kill it, it shuts
| down the whole machine.
|
| Sophos managed to quarantine the ddccb.dll file but isass.exe is still
| running. I've submitted a copy to them and just waiting to hear back
| from them.
|
| I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
| got time to spend hours downloading AV, running scans, reading
| reports. If anyone knows a simpler way of being able to remove this
| pest, please, please let us know!!!

As was stated before is this ISASS.EXE or LSASS.EXE ?

DDCCB.DLL sounds like a Vundo Trojan. Is it C:\windows\system32\ddccb.dll ?

3 phase answer...

Perform Part 1, Part 2 and Part 3

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 6.0,
then you are strongly urged to remove any/all versions.
There are numerous vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 6.0 update 4 (jre 6u4)

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.6.0_04

http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1

Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Part 2
------------
Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.

Part 3
------------
Malwarebytes Anti-Malware 1.05
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

* * * Please report back your results * * *

Frank

unread,

Mar 6, 2008, 1:23:23 PM3/6/08

to

<ming.pho...@gmail.com> wrote in message news:8798e8d7-618f-496e...@n77g2000hse.googlegroups.com...

Read
http://www.softwarepatch.com/tips/isass.html

David H. Lipman

unread,

Mar 6, 2008, 4:10:26 PM3/6/08

to

From: "Frank" <bbu...@bqik.net>

| I've got problems with Isass.exe. It's a nasty virus that won't budge.
| It all started with my AV (Sophos) found a file called DDCCB.DLL.
|
| I've tried deleting it manually, CMD, in Safe Mode, everything. I even
| used Processor Explorer from Microsoft to find out what was running it
| and it turns out to be Isass.exe. When you try and kill it, it shuts
| down the whole machine.
|
| Sophos managed to quarantine the ddccb.dll file but isass.exe is still
| running. I've submitted a copy to them and just waiting to hear back
| from them.
|
| I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
| got time to spend hours downloading AV, running scans, reading
| reports. If anyone knows a simpler way of being able to remove this
| pest, please, please let us know!!!
|
| Read
| http://www.softwarepatch.com/tips/isass.html

Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

ming.pho...@gmail.com

unread,

Mar 7, 2008, 3:54:23 AM3/7/08

to

On Mar 6, 9:10 pm, "David H. Lipman" <DLipman~nosp...@Verizon.Net>
wrote:

> From: "Frank" <bbu...@bqik.net>
>
> | I've got problems with Isass.exe. It's a nasty virus that won't budge.
> | It all started with my AV (Sophos) found a file called DDCCB.DLL.
> |
> | I've tried deleting it manually, CMD, in Safe Mode, everything. I even
> | used Processor Explorer from Microsoft to find out what was running it
> | and it turns out to be Isass.exe. When you try and kill it, it shuts
> | down the whole machine.
> |
> | Sophos managed to quarantine the ddccb.dll file but isass.exe is still
> | running. I've submitted a copy to them and just waiting to hear back
> | from them.
> |
> | I'm stumped at how to remove isass.exe. I'm not a geek and I haven't
> | got time to spend hours downloading AV, running scans, reading
> | reports. If anyone knows a simpler way of being able to remove this
> | pest, please, please let us know!!!
> |
> | Read
> |http://www.softwarepatch.com/tips/isass.html
>

> Download and execute HiJack This! (HJT)http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

>
> Create a HJT log file and post it in one of the below locations...
>
> { Please - Do NOT post the HJT Log here ! }
>
> Forums where you can get expert advice for HiJack This! (HJT) logs.
>
> NOTE: Registration is REQUIRED in any of the below before posting a log
>
> Suggested primary:http://www.thespykiller.co.uk/index.php?board=3.0
>
> Suggested secondary:http://www.bleepingcomputer.com/forums/forum22.htmlhttp://castlecops.com/forum67.html
>

>
> --
> Davehttp://www.claymania.com/removal-trojan-adware.html
> Multi-AV -http://www.pctipp.ch/downloads/dl/35905.asp

Hey Dave,

Thanks for the suggestions. The program which is running is isass.exe.
And yes the ddccb.dll is in that folder.

I'm going to try your suggestion today.

Fingers crossed!

green...@gmail.com

unread,

Apr 13, 2008, 6:15:15 AM4/13/08

to

On Mar 6, 11:23 am, "Frank" <bbu...@bqik.net> wrote:
> <ming.photograp...@gmail.com> wrote in messagenews:8798e8d7-618f-496e...@n77g2000hse.googlegroups.com...

>
> On 22 Feb, 00:25, "David H. Lipman" <DLipman~nosp...@Verizon.Net>
> wrote:
>
>
>
> > From: "Nan" <N...@discussions.microsoft.com>
>
> > | Well i've tried everything basically and i finally sent it to a repair shop.
> > | they've changed the hard drive, added more memory. for a moment i thought i
> > | was good, but nada.

> > | i stopped gettingisass.exeerror or any of those kind, but now it just

> > | freeze after the vaio screen or the windows xp logon sreen and that's it.
> > | and they're telling me there checking or whatever, but it has been there a
> > | week and still nada!!!
> > | what could be causing this????
> > |
>
> > I have no idea. The symptoms are vague.
>
> > For me, the ONLY repair shop would be Sony at this point.
>
> > --
> > Davehttp://www.claymania.com/removal-trojan-adware.html
> > Multi-AV -http://www.pctipp.ch/downloads/dl/35905.asp
>

> I've got problems withIsass.exe. It's a nasty virus that won't budge.

> It all started with my AV (Sophos) found a file called DDCCB.DLL.
>
> I've tried deleting it manually, CMD, in Safe Mode, everything. I even
> used Processor Explorer from Microsoft to find out what was running it

> and it turns out to beIsass.exe. When you try and kill it, it shuts
> down the whole machine.
>
> Sophos managed to quarantine the ddccb.dll file butisass.exeis still

> running. I've submitted a copy to them and just waiting to hear back
> from them.
>

> I'm stumped at how to removeisass.exe. I'm not a geek and I haven't

> got time to spend hours downloading AV, running scans, reading
> reports. If anyone knows a simpler way of being able to remove this
> pest, please, please let us know!!!
>
> Readhttp://www.softwarepatch.com/tips/isass.html

Not sure your problem was the same as the one i saw recently, but the
isass.exe seen was part of a rootkit collection. google "AVG Anti-
Rootkit". This free app revealed a number of hidden files,
directories, and register keys and moved them aside, including the
isass.exe nuisance. Many of the files were dumped in c:\windows\debug
\WPA\*.

Others have suggested that you should obtain assistance by posting
your HiJackThis log to other forums for assistance in diagnosing
potential problems. Also consider submiting your isass.exe to:
http://www.threatexpert.com/