Member Avatar for Hedrog

Dell Latitude D610 P4, 512mb, 30gb HD, XP Pro SP2

Please help. My daughter's laptop caught a virus which avg found. She tried to quarantine it but it kept reappearing. She then tried deleting it, then on startup, a window appeared entitled 'Isass.exe' with the message 'An invalid parameter was passed to a service or function'. When the 'ok' button was pressed the machine would reboot and the message would reappear whether in safe mode or not. So these are my problems:

1. I removed the HD and tried to save her files onto my PC, but as her system uses a password to log on I was denied access.

2. I tried to repair the boot files using recovery console but I was denied access to that as well as a previous owner has set up an administrator password - enter doesn't work.

3. We decided to bite the bullet and risk a repair install of XP, all was fine until the 2nd half of installation. The blue setup window appeared and so did the damn Isass.exe box.

So now the machine is stuck halfway through the installation and nothing I do seems to make any difference. If you have solutions to any of the above I'd be extremely grateful. I've trawled the forums but none of the posts seem to have ALL these problems.

Thanks!

  • 2 Contributors
  • 3 Replies
  • 281 Views
  • 4 Weeks Discussion Span
  • Latest Post Latest Post by Hedrog

Dani AI

Generated

Quick expert addendum:

"isass.exe" is almost always a malicious impostor of Windows' legitimate lsass.exe (Local Security Authority Subsystem Service). The real lsass.exe lives in C:\Windows\System32; any similarly named executable found elsewhere (or spelled with an extra letter) should be treated as hostile. These trojans commonly block logons, interfere with Recovery Console/repair installs, and can re-install themselves if the system remains booted.

Recommended workflow for data preservation and recovery:

  • Preserve the disk image first. Avoid repeated attempts to boot the infected install.
  • Remove the drive and attach it to another computer with a USB enclosure/adapter, or boot the laptop from a Linux live USB or Windows PE rescue environment. That prevents the malware from running while files are copied.
  • If Explorer reports "Access Denied" because of NTFS ACLs, either take ownership via the folder Properties -> Security -> Advanced -> Owner (set to Administrators and check "Replace owner on subcontainers and objects") or grant Administrators full control from a command prompt on the attached drive:
cacls "D:\Documents and Settings\<username>" /E /G Administrators:F
  • A Linux live environment will bypass NTFS permissions and allow copying, which is often the simplest route. Important caveat: EFS-encrypted files require the user’s encryption certificate/key — resetting passwords or taking ownership will not decrypt EFS data.

If the Recovery Console requests an unknown Administrator password, offline password-reset tools (for example chntpw on a Linux live disk) can clear it — but image the disk first, because changing SAM entries can break EFS and other things.

Malware removal and reinstall guidance:

Run an offline AV rescue scan before attempting an in-place repair; if the infection blocks setup or persists, a full wipe and clean install after securely backing up data is the safest fix. Scanning the drive from another, clean system (as suggested) and then doing a clean install (as ultimately did) is frequently the quickest, most reliable recovery path. After reinstall, fully patch Windows, install reputable antivirus, and enable regular backups.

Recommended Answers

All 3 Replies

Member Avatar for caperjack

try putting it in you computer again and use your antivirus program to scan the harddrive to remove any viruses

Member Avatar for Hedrog

Thanks caperjack - I'll try that & post back the results.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.