Can't Boot Up

[tshall]

I'm not sure what happened. I was out for most of the day and came back to a black screen and the computer was on. I rebooted and received the following message...Problem seems to be caused by the following file Win32k.sys, address BF804A5B, base at BF800000, Date stamp 43446a58. Does anybody have any idea what is going on here? I actually did boot up once but couldn't go anywhere, then when I tried again I got this message...Isass.exe the application failed to initialize properly (0x0000005). I'd certainly appreciate any suggestions, ideas, or guidance. Thanks in advance.

ps Windows XP Home

[gary_hendricks]

Could you give a breakdown of your system specs? It could be due to any reason - but maybe video or network driver issues are likely.

[tshall]

Thanks for the reply Gary. It's been a long time since I set this desktop up. It has an ATI 9550 Radeon video card but I don't remember what the network driver is. I just booted it up again though and now it's gone to the welcome screen then when I try to log on it says I need to activate my copy of windows. I haven't changed any hardware or anything, wasn't there a virus at one time that did this kind of thing?

[glc]

Yes - Isass is a virus, Lsass is not. Boot it into safe mode with networking and do some malware scans.

[tshall]

Thank you glc! I got back in by reactivating windows. Then tried to reboot into safe mode and got this message, "the session manager initialization system process terminated unexpectdly with status of 0x000026c. I then rebooted and got another error "Bad Pool Caller". I can't seem to reboot into safe mode either. Any help will be very much appreciated and thanks in advance.

Just tried again and got this one "Stop: C0000219 (Fatal System Error) The session manager initialization system process terminated unexpedly with status of 0x000026c (0x00000000) The system has been shut down.

[glc]

You have malware. Remove the drive and slave it into a PROTECTED computer, and scan it with everything you can throw at it.

[faulkner132]

I've run into this issue with Isass on a couple of computers. After much tooling round, I never could get it back to where it was 100% stable. Ended up in both cases backing up the data and doing a fresh install.

[tshall]

I'm afraid you're right glc. I looked on the symantec website and they suggested looking in the registry for Isaas. Before I did that I had run jvpowertools and cleaned the registry. When I did end up checking the registry I could not find Isaas. I'm now on the same computer and it is acting pretty much normal again. I scanned with Norton AV and it found nothing, but I tried to run the malicious spyware download and it said "Can't start the Engine", Error Code-0x004. Also, while I can run a scan in Norton, windows says my av is turned off. What a strange ordeal this has turned into.

Will this virus go thru my network and get into my other two computers? I'm scanning my laptop now with McAfee. This computer is using Norton, but my subscription runs out in about six days and I was thinking of getting something else, but not sure what yet.

I do have stomp backup my pc and could go ahead and do a major backup, but will I just infect it again? Thanks.

glc I have another drive slaved to the hd, how about if I back up everything except windows and norton and reinstall them.

[glc]

Try the following 2 online scans:

http://www.trendmicro.com/hc_intro/default.asp
http://www.ewido.net/en/onlinescan/

Get rid of Norton when you get it cleaned up and get Free AVG.

http://free.grisoft.com/doc/2/lng/us/tpl/v5

It's not Isaas - it's Isass.