Hello everybody,

I was uninstalling O&O Defrag 10 from my PC using Revo uninstaller, because I had recently installed O&O Defrag 11.

Upon rebooting my PC I received the following messages: I don't remember the exact order.

The archive for Iobit 360 appears to be corrupted.

Problem with corrupt files in Windows, use CKDSK.

One of the files containing the system's registry data had to be recovered by use of a log or alternate copy. The recovery was successful.

My system became unstable, and remained so after several reboots, I also lost my internet connection.

I rebooted into safe mode with networking but was still unable to get online. I attempted to use System Restore in regular windows mode, but was unsuccessful. I was able, after several attempts, to use system restore in safe mode, restoring the system to the day before. Upon a reboot the system was still unstable.

Under the circumstances I thought perhaps it would be best to attempt to recover my OS from the system recovery partition. I received the following message when making the first attempt.

NTLDR is missing. Problems extracting NET framework.

Upon starting the OS recovery from the recovery partition I started to receive the following several different times:

Problems extracting files.

I then tried to recover the system using the recovery CD's I had made. Again I kept receiving the message:

Problems extracting files.

The first of 5 recovery CD's was ejected and the PC shut down.

Upon restarting the system it seems as if it was going to start up. The Windows sign came on then I got the following message:

Isass.exe System error. An invalid parameter was passed to a service or function. Then the screen and my mouse pointer froze.

Upon a restart the Windows screen appears then a blue screen (Windows DSKCHK) I think, then nothing further.

I'm unable to progress past this point, and am at the limits of my sparse knowledge.

I would to thank everybody in advance for your time on my behalf, and hope someone can advise me on how to proceed.

Thank you, I await your replies.

Enrico










Well just as two possible situations which might be your problem...

There's a strong possibility that this is a virus, unfortunately. The LSASS process manages user logins, and as such is a common target for infections on PCs running various versions of Windows.

The worm can easily exploit the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system. To propagate, it scans the network for vulnerable systems. When it finds a vulnerable system, this malware sends a specially crafted packet to produce a buffer overflow on LSASS.EXE. This worm can cause LSASS to crash and force Windows to restart.

SASSOR Virus varies but can attack the network, Isass.exe and cause crashes. You might WANT to check for that.

Iobit 360 is security software, but also has a range of system tweaks / clean up tools. These clean up tools might of failed, however they create restore points and the restore should of been stable again.

If it is a virus however, it could also hide in your system restore, so might of recovered itself from there.

Disconnect from the net, use a removal tool.

The other possible answer is the hard drive itself is failing or damaged. If it's slightly chipped inside, after use, creates more and more drive errors. Chkdsk will normally fail or create more issues if this is the case. Solution is a replacement drive.

Good LUCK!Quote

The other possible answer is the hard drive itself is failing or damaged. If it's slightly chipped inside, after use, creates more and more drive errors. Chkdsk will normally fail or create more issues if this is the case. Solution is a replacement drive.

This is what happened. a Virus in LSASS would have absolutely nothing to do with the recovery partition having problems extracting files, or of recovery CDs having the same problem.

However, CHKDSK on a physical damaged / dying hard drive is basically suicide for your data. CHKDSK is not a data recovery utility. It doesn’t behave like one. Data recovery utilities are cautious. If the sector is not readable, it will leave it be. CHKDSK will tenaciously retry until the data is not recoverable, mark the sector unrecoverable, and basically make recovering data a lot more difficult.

only way to get at this data is via S.M.A.R.T.

your terms a little odd- you define three "sector" types. normal readable sectors, and apparently there are two distinct "issue" sectors. unreadable and unrecoverable. they are the same, though. an unreadable sector is by definition unrecoverable; an unrecoverable sector is unrecoverable because it is unreadable.

chkdsk /r, when doing a surface scan, moves data from sectors that are failing. if the access time takes to long, it takes this as a sign that the sector is failing, and copies the data elsewhere and changes the assignment in the MFT or FAT. And marks the original (slow) sector as bad.

Modern hard drives also reassign sectors within their firmware; the circuitry may determine that a sector is failing by the same logic (long access time) and reallocate that sector to one of it's scratch sectors, automatically. if you run chkdsk in this situation with a bad sector, the drive itself copies the data from that sector to one of the scratch sectors and marks off in it's servo platter that it should remap all requests for data in that sector to the scratch sector it used. chkdsk has no knowledge of this. in fact, the only way to get at this data is via S.M.A.R.T.

In either case, the only reason chkdsk would cause more issues in the case of a physical drive issue (chipped? more like scratched from a head crash) is simply because it's accessing the drive. the same issues would occur with any drive access by any application. It's not an issue with chkdsk- it's an issue with the drive. this is like blaming chkdsk for corrupting your data when your hard drive catches fire.

I do not have a virus. It's Isass.exe. Not Lsass.exe.

Maybe you can help me? I believe what you're saying, but what makes this different?