I have this caption on my friends Laptop at start up complaining of Isass.exe file. I have tried to can for virus with
Mcafee and AVG but still comming up.

"Windows cannot fine C:\WINDOWS\system\isass.exe"make sure you typed the name correctly, and then try to search for a file, "
How can I solve this problem

Hey man, they was a virus in that system that has been deleted, but when the virus came in, it added a value tu your registry to start up that file every time Windows boots, so u have no problem.

To get rid of that shit;
Type MSCONFIG in the run box, click on the Start up tab and uncheck it if found there.
If u dnt find it.

Look under HKCU, navigate to Software>Microsoft>Windows>Currentversion>Run .
The value shuld be there, back up your registry before u mess with it

Hi Ralvy, thanks, it didnt work. First I did not find the file at msconfig and also HKCU
"HKCU, navigate to Software>Microsoft>Windows>Currentversion>Run " I navigate to the Run there was no value come out.
what should I do again?

LOL, I was talkn tu like that cz I thot your an advanced user .
Well, let me take it slowly . .  Since u said u typed "msconfig" in the runbox from the start menu and u didnt find it checked there, that's still no problem,

When u hear HKEY_CLASSES_ROOT, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, HKEY_USERS and anything like that.
We are referring to the Registry.
To get to the Registry Editor, Type "regedt32" in the run box from the start menu.

You get the registry editor open as illustrated below, now as I said Navigate, I mean u shuld keep expanding as u find what I said, If I had a system with the same problem, I wuld have written a registry value to stop that pop -up.

Try what I said above, it is surely under run in the registry.
Whatever, the case is - let me know, and I wuls search through ma registrt tu c if I can compile sth to stop that.

I will get back tu u shortly.

Chief Ralvy, i am an advance user ok. I hv done all that. thru regedit, there was no value at HKCU, navigate to Software>Microsoft>Windows>Currentversion>Run ". When I get to RUN i click on it no value came at the other window (panel).I also search thru msconfig i cant fine that files and its directory there.
I did all this at safe mode. i can see u are online can we IM ?

Hw fast is ur connection . .

Remote assistance may be the solution . .

Yes! I'm online . . hit me

@sholasys

Just like Ralvy said, its a virus that has been deleted, but the associated registry file is still there.

It seems you only checked under the HKCU path. Well, the root paths in the registry actually defines the scope within which the entries/values are defined i.e User based, Machine wide, User group rules, e.t.c

You could just run a search in the registry for "isass.exe". Once a match is found, delete it.

Check for it under the "\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" of the following registry paths:

- HKEY_CURRENT_USER
- HKEY_LOCAL_MACHINE
- HKEY_USERS
- HKEY_CURRENT_CONFIG

A search would be preferred to rule out the possibility of it registering itself with more than one entry name.

After that, try restarting your system once more.

Thanks Maleeq The problem is that i cant see Run on the start button and it complain that registry hv been disabled by admin. except o go thru safe mode

O man! You've still got some virus on that system of yours!

To get the "RUN" back:

- Right click on the "Start" button and select "Properties"
- Next, select the "Customize" button.
- Select the "Advanced" tab.
- Under the "Start Menu Items", scroll down to "Run Command" and check it. If it is already checked, uncheck it and then check it again.
- Click on "OK" twice.
- It should have been restored.


To get the registry editing available:

- Start the command prompt (under "Start -> Accessories"
- Type in "gpedit.msc"
- In the windows that comes up, expand the "User Configuration" node
- Further expand the "Administrative Templates" and then click on "System"
- Now, on the right-hand pane, you should see an entry that says "Prevent Access to registry editing tools". Double click it.
- If it is enabled, disable it. If it is disabled, enable it and then disable it again to overwrite the registry entry.
- You can then close the windows and try to access the registry again.


Tips:
You could also get the "Run" command back by following the same steps as for the registry issue, only this time you click on "Start Menu And Task Bar" and not "System"
- Then look for the entry that reads "Remove Run menu from Start Menu"
- If it is enabled, disable it.
- If it is disabled, enable and then disable it again.