Member Avatar for brimstone

hello I was wondering if I could be helped. My moms computer has caught the sasser virus isass.exe an invalid parameter was passed by a function or something along those lines at start up of her computer she runs windows xp profesional. I tried booting it into safemode and i get the same error.

  • 5 Contributors
  • 5 Replies
  • 325 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Dell_1

Dani AI

Generated

Short, practical summary and next steps for the isass/isass.exe Sasser symptom reported by .

This symptom matches the classic Sasser family: a worm that exploited a buffer overflow in the Local Security Authority (LSASS) service (Microsoft Security Bulletin MS04-011) and can crash LSASS, trigger the automatic shutdown/restart behavior, and drop files such as variants named like isass/lsasss/avserve. The infection can spread without user action over vulnerable XP/2000 systems, which is why it often looks like an immediate “takeover.” Microsoft MS04-011 and vendor writeups describe the behaviour and payloads. (learn.microsoft.com)

If the PC will not boot to a usable desktop (Safe Mode shows the same error), avoid reinstalling blindly. First isolate the machine from the network (unplug Ethernet / disable Wi‑Fi), then either:

  • Boot the PC from a known-clean rescue environment (bootable AV rescue ISO) and run a full offline scan, or
  • Remove the drive and connect it to a clean machine as an external disk and scan every file there with up-to-date AV.
    Bootable rescue tools let you scan and clean files without starting the infected Windows instance; examples are vendor rescue ISOs that boot and update signatures before scanning. These offline approaches are safer when LSASS crashes on every boot. ()

About reformat/reinstall (what and touched on): a full format and OS reinstall will remove the worm, but it is a last-resort step because user data can be lost. Before wiping, copy only personal documents (no .exe/.msi/unknown installers) to external media and scan those copies on a clean machine. If you reinstall Windows XP, note XP is unsupported (end of support April 8, 2014) — upgrading to a supported OS is strongly recommended after cleanup. After cleaning or reinstalling, install all security updates (including MS04-011-era patches if relevant), enable a firewall and current antivirus, and fully scan before reconnecting to the network. (blogs.microsoft.com)

Practical quick commands (if you can reach a Run box during the 60s shutdown): shutdown -a will abort the countdown so you have time to run tools—but don’t rely on that as a fix. If these steps feel risky, consider professional recovery so data isn’t lost or reinfected.

Recommended Answers

All 5 Replies

Member Avatar for brimstone

hello thanks for the reply however the problem persists that the computer is virtually usless i cant boot it up or else i get the same error. Also when i tried to get into safemode the same error occured so i was wondering If i was to just format the harddrive and reinstall the operating system would that do the trick and get ride of the sausser virus?

Member Avatar for DavidB

It would get rid of the virus, but reformating your computer is a pretty drastic step to take just to get rid of one virus. Before taking such a step, is all important information from the computer backed up? If not, it would all be lost when the computer is reformated. Is there any anti-virus software on the computer that can be run?

Member Avatar for Reverend Jim

If you have access to another computer you could download TrendMicro Housecall and burn it to a CD. Boot the infected computer from that CD to run.

Member Avatar for Dell_1

instal Bitdefender Internet Security and uptade it

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.