Manual Removal of isass.exe

isass.exe (Futro Trojan)
isass.exe is considered to be a security risk, not only because antivirus programs flag Futro Trojan as a trojan, but also because other sites consider it a Trojan as well.
Futro Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of isass.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information.


Download Hijackthis Auto Removal Tool for isass.exe (Sasser worm)
Other Tools for Removing Isass.exe
Microsoft Sasser Removal Tools and Instructions

Damage Level: Medium
Distribution Level: Medium


Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 when your Screen turns on, Select Safe mode, press enter.

The Infected Files Can be Seen in these folders and names
Kill the following processes and delete the appropriate files:

• ISASS.EXE
• issas.exe
• MSHLPAPI.DLL
• MSSVCHST.DLL
  

Delete the following malicious registry entries and\or values:

• Key: Software\Microsoft\Windows\CurrentVersion\RunOnce
  Value: Anti

• Key: Software\Microsoft\Windows\CurrentVersion\RunOnce
  Value: InternetSecurityAssistant

• Key: Software\Microsoft\Windows\CurrentVersion\RunOnce
  Value: Isass

• Key: Software\Microsoft\Windows\CurrentVersion\RunOnce
  Value: NvMsnW

• HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry or entries:
InternetSecurityAssistant "%Windows%\ISASS.EXE"

• HKEY_USERS>.Default>Software>Microsoft>Windows>CurrentVersion>RunOnce

In the right panel, locate and delete the entry or entries:
InternetSecurityAssistant "%Windows%\ISASS.EXE"
 
In the left panel, double-click the following:
• HKEY_CURRENT_USER>System>CurrentControlSet>Control>LSA>

In the right panel, locate and delete the entry:
WIN32 = “WIN32.exe”

In the left panel, double-click the following:
• HKEY_CURRENT_USER>Software>Microsoft>OLE>

In the right panel, locate and delete the entry:
WIN32 = “WIN32.exe”

In the left panel, double-click the following:
• HKEY_LOCAL_MACHINE>Software>Microsoft>OLE>

In the right panel, locate and delete the entry:
WIN32 = “WIN32.exe”

In the left panel, double-click the following:
• HKEY_LOCAL_MACHINE>System>CurrentControlSet>Control>LSA>

In the right panel, locate and delete the entry:
WIN32 = “WIN32.exe”

Close Registry Editor.
Restart your PC.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Hijackthis (Freeware)