Matt H wrote:
<paste>
> "PA Bear" wrote:
>> ISASS.EXE or LSASS.EXE?
>>
>> Are you running a fully-patched version of WinXP SP2?
>> --
>> Matt H wrote:
>>> during startup I get the following message.
>>>
>>> Isass.exe - Application Error
>>> The application failed to initialize properly (0xc0000096). Click ok
>>> to
>>> terminate application
>>>
>>> I click ok and the message goes away however all I get is a black screen
>>> with my arrow for my mouse. This also happens in safe mode only once I
>>> click ok and close the message I can see safemode in all 4 corners.
</paste>
> "David H. Lipman" wrote:
>> From: "Matt H" >
>>> Yup
>>>
>> Yup what ?
>>
>> Robear asked you a specific question...
>> "ISASS.EXE or LSASS.EXE?"
>>
>> Please answer !
>> --
> SORRY!! been a long day
> Isass
You've got a Win32.OptixPro infection, most likely (cf.
http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=39482).
Repost: Are you running a fully-patched version of WinXP SP2?
Are you running a reputable anti-virus application with updated definitions
and have you run a full system scan with it (preferably in Safe Mode)?
Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.
Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org